Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 15:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09bd19605de3262ae7f8f2355d430300N.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
General
-
Target
09bd19605de3262ae7f8f2355d430300N.exe
-
Size
92KB
-
MD5
09bd19605de3262ae7f8f2355d430300
-
SHA1
450b0affa561fa73db6b372294db839a34a328d1
-
SHA256
ce74d4663834f10b00d027addaf44e64e3c0df6b12d2152d57d945abbb2bc210
-
SHA512
2424d541fbc8147abd4ec5593aed36d7977309af175eb7f8d8955b3aee5d9671cf57dcf33803042378d91771d41b16f3cd4b850c5b7658983fa2fc622411673d
-
SSDEEP
1536:DHB0UxMkzOt7HcvJGt5AdHIOWnToIf12ZqTUga1of0o:DhAWJGSCTBf12Z1g4of0
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\ATTRIB.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\CACLS.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWS.MEDIA.BACKGROUNDPLAYBACK.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\ISCSICLI.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\MMGASERVER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\RUNONCE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\UNREGMP2.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\WLANEXT.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\WOWREG32.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\FIND.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\GPSCRIPT.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\ICACLS.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\RMCLIENT.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\TZUTIL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\TASKMGR.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\WERFAULTSECURE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\CHOICE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\FTP.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\GPUPDATE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\IEUNATT.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\NETSH.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\CMD.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\CREDWIZ.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\CURL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\NETPLWIZ.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\USERACCOUNTCONTROLSETTINGS.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\DPLAYSVR.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPUEXC.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\NET.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\TCPSVCS.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\DISKPERF.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\EUDCEDIT.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\INSTNM.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\LAUNCHWINAPP.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\RASDIAL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\DCCW.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\EVENTCREATE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\GPRESULT.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\MSDT.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\PKGMGR.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\RELOG.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHFILTERHOST.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\DPISCALING.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\EVENTVWR.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\REGINI.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\SYNCHOST.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\USERINIT.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\DISM\DISMHOST.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\SPEECH_ONECORE\COMMON\SPEECHMODELDOWNLOAD.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMINFO.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\CLEANMGR.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\FONDUE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\SCHTASKS.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\SETX.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESHARDWARE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\WERFAULT.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\WHOAMI.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\WRITE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\AT.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\CMDKEY.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\CMSTP.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\EXPAND.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\EXPLORER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SysWOW64\RDPSA.EXE 09bd19605de3262ae7f8f2355d430300N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVAWS.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.NETFX40.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\WORDICON.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MSPAINT_6.1907.29027.0_X64__8WEKYB3D8BBWE\PAINTSTUDIO.VIEW.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSMAPS_5.1906.1972.0_X64__8WEKYB3D8BBWE\MAPS.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\MIP.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAR.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAH.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JRUNSCRIPT.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX86\MICROSOFT SHARED\EQUATION\EQNEDT32.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSTICKYNOTES_3.6.73.0_X64__8WEKYB3D8BBWE\MICROSOFT.NOTES.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.195.15\MICROSOFTEDGEUPDATECORE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JCONSOLE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OSMADMINICON.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SKYPEAPP_14.53.77.0_X64__KZF8QXF38ZG5C\SKYPEBACKGROUNDHOST.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\FULLTRUSTNOTIFIER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.195.15\MICROSOFTEDGECOMREGISTERSHELLARM64.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVACPL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\XLICONS.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WAB.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\6.0.27\CREATEDUMP.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ONENOTE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\MSOUC.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.DESKTOPAPPINSTALLER_1.0.30251.0_X64__8WEKYB3D8BBWE\APPINSTALLER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFT3DVIEWER_6.1908.2042.0_X64__8WEKYB3D8BBWE\VIEW3D.RESOURCERESOLVER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPSHARE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\123.0.6312.123\INSTALLER\SETUP.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVA.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\EXCELCNV.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOIA.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVCLEANER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SERVERTOOL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX64\MICROSOFT ANALYSIS SERVICES\AS OLEDB\140\SQLDUMPER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\GRV_ICONS.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNSCFG.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DISABLEDGOOGLEUPDATE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\BROWSER\WCCHROMEEXTN\WCCHROMENATIVEMESSAGINGHOST.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.195.15\MICROSOFTEDGEUPDATEBROKER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\INPUTPERSONALIZATION.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JP2LAUNCHER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\INTEGRATION\INTEGRATOR.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOEV.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PINGSENDER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION_4.4.8204.0_X64__8WEKYB3D8BBWE\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\TABTIP32.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\123.0.6312.123\ELEVATION_SERVICE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KTAB.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\SERVERTOOL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\RMIREGISTRY.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PRIVATE_BROWSING.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\MSEDGE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\INSTALL\{0D7441D9-805B-4A69-8B48-2E7E818702D0}\CHROME_INSTALLER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.195.15\MICROSOFTEDGEUPDATE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAP.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\WSIMPORT.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KTAB.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE 09bd19605de3262ae7f8f2355d430300N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SERVICING\TRUSTEDINSTALLER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-CONTAINERDIAGNOSTICSTOOL_31BF3856AD364E35_10.0.19041.928_NONE_6571FF6E96271A64\F\HCSDIAG.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_WP.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MICROSOFT.WORKFLOW.COMPILER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\REGSVCS.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\CSC.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINUTIL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\HELPPANE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\NCSIUWPAPP_8WEKYB3D8BBWE\NCSIUWPAPP.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\WSATCONFIG\3.0.0.0__B03F5F7F11D50A3A\WSATCONFIG.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\APPLAUNCH.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\SERVICEMODELREG.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\PRINTDIALOG\PRINTDIALOG.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-CONT..UTIONSERVICE-SHARED_31BF3856AD364E35_10.0.19041.928_NONE_33E0D5558CDD7C61\N\CEXECSVC.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WFSERVICESREG.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGASM.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.PINNINGCONFIRMATIONDIALOG_CW5N1H2TXYEWY\PINNINGCONFIRMATIONDIALOG.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ADELRCP.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\VBC.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SYSMON.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WIN32WEBVIEWHOST_CW5N1H2TXYEWY\WIN32WEBVIEWHOST.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\RDRSERVICESUPDATER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\ADDINPROCESS32.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\SHELLEXPERIENCEHOST_CW5N1H2TXYEWY\SHELLEXPERIENCEHOST.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-CONT..UTIONSERVICE-SHARED_31BF3856AD364E35_10.0.19041.928_NONE_33E0D5558CDD7C61\CEXECSVC.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\HH.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\COMSVCCONFIG.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\NGEN.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_CASPOL_B03F5F7F11D50A3A_4.0.15805.0_NONE_C6DC1994DB088235\CASPOL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_64\MSBUILD\3.5.0.0__B03F5F7F11D50A3A\MSBUILD.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMCONFIGINSTALLER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.ASSIGNEDACCESSLOCKAPP_CW5N1H2TXYEWY\ASSIGNEDACCESSLOCKAPP.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMMANDLINE-TOOL_31BF3856AD364E35_10.0.19041.1_NONE_E2F75FDA217D5015\HVC.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\BOOT\PCAT\MEMTEST.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_STATE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DFSVC.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGSQL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.ECAPP_8WEKYB3D8BBWE\MICROSOFT.ECAPP.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.SEARCH_CW5N1H2TXYEWY\SEARCHAPP.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_DATASVCUTIL_B77A5C561934E089_4.0.15805.0_NONE_5B1ADA239E3B0505\DATASVCUTIL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-GUESTCOMPUTESERVICE_31BF3856AD364E35_10.0.19041.1202_NONE_024525BDC81DF50D\VMCOMPUTEAGENT.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_REGBROWSERS.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CASPOL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMMANDLINE-TOOL_31BF3856AD364E35_10.0.19041.928_NONE_0B17415AE0DD0379\HVC.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\PRESENTATIONFONTCACHE\3.0.0.0__31BF3856AD364E35\PRESENTATIONFONTCACHE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_32\MSBUILD\V4.0_4.0.0.0__B03F5F7F11D50A3A\MSBUILD.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\VBC.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CVTRES.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\MSBUILD.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-GUESTCOMPUTESERVICE_31BF3856AD364E35_10.0.19041.264_NONE_6B6699B671C8F5A8\F\VMCOMPUTEAGENT.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DFSVC.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_REGSQL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.PEOPLEEXPERIENCEHOST_CW5N1H2TXYEWY\PEOPLEEXPERIENCEHOST.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_EVENTVIEWERSETTINGS_31BF3856AD364E35_10.0.19041.1_NONE_AAE8E58AA310AA7D\EVENTVWR.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4BITMAPIBROKER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\APPLAUNCH.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.ASYNCTEXTSERVICE_8WEKYB3D8BBWE\MICROSOFT.ASYNCTEXTSERVICE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.NARRATORQUICKSTART_8WEKYB3D8BBWE\NARRATORQUICKSTART.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADDINUTIL_B77A5C561934E089_4.0.15805.0_NONE_FCD173BC1B434B81\ADDINUTIL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\READER_SL.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_COMPILER.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_STATE.EXE 09bd19605de3262ae7f8f2355d430300N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ILASM.EXE 09bd19605de3262ae7f8f2355d430300N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 09bd19605de3262ae7f8f2355d430300N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09bd19605de3262ae7f8f2355d430300N.exe"C:\Users\Admin\AppData\Local\Temp\09bd19605de3262ae7f8f2355d430300N.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3952