Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 11:57
Behavioral task
behavioral1
Sample
6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe
Resource
win7-20240729-en
windows7-x64
4 signatures
150 seconds
General
-
Target
6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe
-
Size
379KB
-
MD5
926a01696875d72ecaab7ff449d7ede5
-
SHA1
28bd9c751335fe2829e91282367ece400e2d6d64
-
SHA256
6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5
-
SHA512
fb3b544a7f4943530ce0f77568a23c14e0bb84f883e6c52307053c7518cc6a92d9efb4c6146ce217badf23a643326f344b74ecb546731c0163e1633b645ea689
-
SSDEEP
3072:mYjW/6oSC5wztj5xiE1QM07ucjnDc/yd4eRYZ4StVAO8q+ysAg0AxB/GTGKLmKnc:fj2jwzt+sQM07LbSt7n2A4B/OfrC9
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3092-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x00090000000233f0-5.dat upx behavioral2/memory/3092-2063-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3092-4241-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\certutil.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\cmd.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\RdpSa.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\certreq.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\dplaysvr.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\msiexec.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\scrnsave.scr 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\shrpubw.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\winrs.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\net1.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\unlodctr.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\compact.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\eventvwr.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\clip.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\DpiScaling.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\printui.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\xcopy.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\netsh.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\odbcconf.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\runas.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\TpmInit.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\credwiz.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\dllhst3g.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\dtdump.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\fc.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\isoburn.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\odbcconf.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\PING.EXE- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\fsquirt.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\mobsync.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\mstsc.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\ReAgentc.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\rekeywiz.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\w32tm.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\Dism.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\xwizard.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\msra.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\newdev.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\regedt32.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\regsvr32.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\SysWOW64\ctfmon.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.195.15\MicrosoftEdgeComRegisterShellARM64.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.15\MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\f\hvsirpcd.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.1_none_c564589414ffc535\mmc.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.84_none_f9792ddb393f9467\rdpclip.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\r\TSTheme.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.19041.1_none_3a8d8b0c2eae5eda\DpiScaling.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\appidpolicyconverter.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.19041.746_none_d99fd60bc1fde773\LockAppHost.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_4b1a1978d1832a5f\OpenWith.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-write_31bf3856ad364e35_10.0.19041.1_none_1573dfb37c7563ca\write.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\36f22f4236e5d701239700001815341f.nfsclnt.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_5b834788c0d17953\f\iexplore.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.19041.1_none_d151c6f3c90b1e0b\RunLegacyCPLElevated.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.19041.1_none_34f70c73dc049744\stordiag.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\f\DeviceCredentialDeployment.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_1f65f7473443d565\cmstp.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.19041.1_none_1c5807cd8d0c767e\OptionalFeatures.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_610e6b21ab533b13\autochk.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.1_none_e768b85cf7ad062e\TSWbPrxy.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_949b3f6674b404fa\PasswordOnWakeSettingFlyout.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\x86_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_4c95cf26b3aa5907\r\CredentialUIBroker.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.746_none_49c7c9a4b745444e\f\PhotoScreensaver.scr- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\r\ApplySettingsTemplateCatalog.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\wbengine.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.19041.1_none_c1f3db00edc86845\dvdplay.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.19041.1_none_a241f61a9ca1102c\tcmsetup.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\f\msra.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.19041.1_none_ba28e703f717d172\wlanext.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.19041.746_none_61e0347e850155a8\UserOOBEBroker.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\f\wscadminui.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1202_none_a5b2e5b8b986fe3d\r\wininit.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\f\sftp.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\sftp.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_10.0.19041.1_none_421bb61742382b2d\MSBuild.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.264_none_29367e02ede71097\wbadmin.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.572_none_3e399e76562f6053\netbtugc.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\f\cscript.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\UNPUXLauncher.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15805.0_none_be984aad4cfbc2f3\csc.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.19041.1_none_260e545bf60f6b0f\cliconfg.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.19041.746_none_a39f6d9ab59bd8b7\MsMpEng.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.1151_none_b46b739f71bbb8b7\r\bash.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_wcf-smsvchost_b03f5f7f11d50a3a_10.0.19041.1_none_b4528a0bdf7b6cee\SMSvcHost.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\r\windeploy.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\PrintDialog\PrintDialog.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\f\hvsimgr.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.117_none_1db60e061b48335a\f\bash.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.19041.153_none_59d1094dec9b8480\Spectrum.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1_none_03cd5b18c0751679\mstsc.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1266_none_85eec0307bfb088e\WPDShextAutoplay.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_81cc87a43da05fd1\control.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\f2329d4736e5d7010ba200001815341f.iissetup.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\f\sethc.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_e304dcaa2490f61c\f\SystemUWPLauncher.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.19041.1_none_579ae2e26c347896\WMIC.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\dsdbutil.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_4.0.15805.0_none_d67d06ef0c4a2e1c\InstallUtil.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.19041.1_none_075470a68fcfb411\mount.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_21d0a68ccdc67be8\r\wusa.exe- 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe"C:\Users\Admin\AppData\Local\Temp\6fd4d90b3e9eda56e3f77f416311afc23737292d3fd249af70797e4e624a6fb5.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
924KB
MD5b3019f31b3d0f4c4a8e661a9f9ff9b6e
SHA16ef30b629ba95c4dd805c9b105237daff832d1bc
SHA256924c645861ccb4ce46aa2474830a9d0bc07c8a0504b51d6e1361e02d288d3db0
SHA512f046947923c0ab59f33d5007db77094d031239d25b96fd04b3335dae483d601c06275f4f2f3a7954ec26016ccdc970a7bd91b301d7b8b45a679b79d42437d133