Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-09-2024 16:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ea972afe8b5d6b3ee52911dca8535050N.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
General
-
Target
ea972afe8b5d6b3ee52911dca8535050N.exe
-
Size
63KB
-
MD5
ea972afe8b5d6b3ee52911dca8535050
-
SHA1
9c630c96b98522aa1a51542b66425f324256ed75
-
SHA256
e2345ebb1443e5f3e9c884eb8c359c03fcbe31246e7b67029bcef01b870fbde6
-
SHA512
eae0b96fd99e0a34db0e0739bcb932019b99acb468b9d2e2c21ca75b2a5fc058fd635224abd16b4388b8b5698127d8603997c3131f482fb5ff091b6e495c2fc3
-
SSDEEP
768:UcENCjdJIO4VBafkABbXSPo5mR/TWbxYLMCnWvhgpgrElCg0lYioRoPBqnFZ:UcVEO0R/PgYgrEldopIZ
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\SYSKEY.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\COM\MIGREGDB.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\DCOMCNFG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\IME\SHARED\IMCCPHR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\CHKNTFS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\PRESENTATIONHOST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\REG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\SECINIT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\EXTRAC32.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\WSMANHTTPCONFIG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\ATBROKER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMESC5\IMSCPROP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\COMP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\PRESENTATIONHOST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\VERIFIER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\AT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP10\IMJPDADM.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\TAKEOWN.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\VERIFIER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\NTOSKRNL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\WSCRIPT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC10\IMTCPROP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\POQEXEC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\SETIEINSTALLEDDATE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\CHKNTFS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\GRPCONV.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\VERCLSID.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\LABEL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\SETIEINSTALLEDDATE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\AUDITPOL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\OCSETUP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\RMACTIVATE_SSP_ISV.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\TASKKILL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\DLLHST3G.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\PCAUI.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\AUTOFMT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\PCAUI.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\CLIP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\IME\IMEJP10\IMJPPDMG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\UTILMAN.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP10\IMJPUEXC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\LOGMAN.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\REG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\REGSVR32.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\NOTEPAD.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\UNREGMP2.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\REKEYWIZ.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\EXPLORER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\WININIT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\DEVICEPAIRINGWIZARD.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\FINGER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\INSTALLSHIELD\_ISDEL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\DEVICEPROPERTIES.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\SDBINST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\AUTOCONV.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\MIGWIZ\MIGWIZ.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\MSPAINT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\SVCHOST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\WLANEXT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\CALC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\CMD.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSWOW64\DCCW.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\COMPACT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\SERIALVER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\TNAMESERV.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JP2LAUNCHER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MAHJONG\MAHJONG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\RESOURCE\ICONS\SC_READER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JINFO.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVAWS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\SPIDERSOLITAIRE\SPIDERSOLITAIRE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\MSASCUI.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\ONENOTE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS PHOTO VIEWER\IMAGINGDEVICES.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\SERVERTOOL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\ORBD.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MULTIPLAYER\BACKGAMMON\BCKGZM.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE14\MSOHTMED.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS SIDEBAR\SIDEBAR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\RMID.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\TNAMESERV.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\MPCMDRUN.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\SETUP_WM.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPRPH.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MINESWEEPER\MINESWEEPER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\SOLITAIRE\SOLITAIRE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UPDATER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAWS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JSADEBUGD.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\RMID.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\TNAMESERV.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\MSOICONS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSTORDB.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\WINWORD.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\RMIREGISTRY.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JDB.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVACPL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PRIVATE_BROWSING.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWS JOURNAL\PDIALOG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\IDLJ.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE AIR\VERSIONS\1.0\AIRAPPINSTALLER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\UNPACK200.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\KINIT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE AIR\VERSIONS\1.0\ADOBE AIR UPDATER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\OUTLOOK.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\PPTICO.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\FREECELL\FREECELL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\OIS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\POWERPNT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\APT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVA-RMI.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\APPLETVIEWER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\OARPMANY.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSOSYNC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\MOZILLA MAINTENANCE SERVICE\MAINTENANCESERVICE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KINIT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DOWNLOAD\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\CHROME_INSTALLER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\RMIREGISTRY.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATEBROKER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATECOMREGISTERSHELL64.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\CLVIEW.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\DVD MAKER\DVDMAKER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPRPH.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\FLICKLEARNINGWIZARD.EXE ea972afe8b5d6b3ee52911dca8535050N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\COMSVCCONFIG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VBC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FSUTIL_31BF3856AD364E35_6.1.7600.16385_NONE_28590620099DA2D8\FSUTIL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..-DEPLOYMENT-PACKAGE_31BF3856AD364E35_6.1.7600.16385_NONE_BAC291589D407FDE\TFTP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\EXPLORER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\JSC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SYSPREP_31BF3856AD364E35_6.1.7600.16385_NONE_4B73926C122BE805\SYSPREP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..LICATIONS-CLIENTSKU_31BF3856AD364E35_6.1.7601.17514_NONE_7D0125C85CC31D2A\RDPSHELL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-AUTOCHKCONFIGURATOR_31BF3856AD364E35_6.1.7600.16385_NONE_74B76D3FA1757C6F\CHKNTFS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EHOME-WTVCONVERTER_31BF3856AD364E35_6.1.7600.16385_NONE_A8464ACCB5A91F59\WTVCONVERTER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-IECLEANUP_31BF3856AD364E35_11.2.9600.16428_NONE_A03D6846A99C1C87\IECLEANUP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CTTUNESVR_31BF3856AD364E35_6.1.7600.16385_NONE_4BEFC8EB38093BB1\CTTUNESVR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MAGNIFY_31BF3856AD364E35_6.1.7600.16385_NONE_CA22C913B260E66A\MAGNIFY.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-UPNPDEVICEHOST_31BF3856AD364E35_6.1.7600.16385_NONE_1DDD261C4E350476\UPNPCONT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WINVER_31BF3856AD364E35_6.1.7600.16385_NONE_12466FE3B629E036\WINVER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_REGASM_B03F5F7F11D50A3A_6.1.7601.17514_NONE_A3C349B4BDAC0898\REGASM.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SESSION0VIEWER_31BF3856AD364E35_6.1.7600.16385_NONE_3DDBD9A9605F0519\UI0DETECT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-VERCLSID_31BF3856AD364E35_6.1.7600.16385_NONE_17DBC2DD2D2552C7\VERCLSID.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CVTRES.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DEFRAG-ADMINUI_31BF3856AD364E35_6.1.7601.17514_NONE_F73C142DA6E47DAA\DFRGUI.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..ESSAGINGCORESERVICE_31BF3856AD364E35_6.1.7601.17514_NONE_412FCD2AFECDC412\MQSVC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ALSERVICES-WEBPROXY_31BF3856AD364E35_6.1.7600.16385_NONE_8D6C9C807200865A\TSWBPRXY.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-GPOWERSHELL-EXE_31BF3856AD364E35_6.1.7600.16385_NONE_94861149BB66249C\POWERSHELL_ISE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MAPI_31BF3856AD364E35_6.1.7601.17514_NONE_097346BE305F3966\FIXMAPI.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MSAUDITEVTLOG_31BF3856AD364E35_6.1.7600.16385_NONE_23376BF5921E7B63\AUDITPOL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NFS-CLIENTCMDTOOLS_31BF3856AD364E35_6.1.7600.16385_NONE_AD5854CA0A23343D\UMOUNT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ADDINPROCESS32.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\SETUPCACHE\V4.7.03062\SETUPUTILITY.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NETBT_31BF3856AD364E35_6.1.7601.17514_NONE_BE8ACDD10DE3B1A6\NETBTUGC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\DFSVC\2C3E7FDA8DE40E45E7F5E004094DC7C9\DFSVC.NI.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..IUMINBOXGAMES-CHESS_31BF3856AD364E35_6.1.7600.16385_NONE_D0C99374981840D5\CHESS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-SPP-UX_31BF3856AD364E35_6.1.7601.17514_NONE_B9E7A42AB571BBB9\SLUI.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TAPISETUP_31BF3856AD364E35_6.1.7600.16385_NONE_C5E81C6AB4DB0C88\TAPIUNATTEND.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WCF-M_SM_CFG_INS_EXE_31BF3856AD364E35_6.1.7601.17514_NONE_5E47617F33C574AC\SMCONFIGINSTALLER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-VSSADMIN_31BF3856AD364E35_6.1.7600.16385_NONE_207247174B54AF00\VSSADMIN.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CVTRES.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EVENTCREATE_31BF3856AD364E35_6.1.7600.16385_NONE_3157C24B5944E2A3\EVENTCREATE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..NPUTPERSONALIZATION_31BF3856AD364E35_6.1.7600.16385_NONE_9BA1049CE0053BEF\SHAPECOLLECTOR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..WSUPDATECLIENT-CORE_31BF3856AD364E35_7.5.7601.17514_NONE_1F3413AFC64D10C5\WUAUCLT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\EHOME\LOADMXF.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ADAPTERTROUBLESHOOTER_31BF3856AD364E35_6.1.7600.16385_NONE_2DF6395B9CF7E9A5\ADAPTERTROUBLESHOOTER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..TING-TOOLS-PRINTBRM_31BF3856AD364E35_6.1.7601.17514_NONE_DFE02DE35BF41E0B\PRINTBRM.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\LOADMXF\6.1.0.0__31BF3856AD364E35\LOADMXF.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DFSVC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-DW_B03F5F7F11D50A3A_6.1.7600.16385_NONE_5A768666C3091014\DW20.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSBUILD\F4A88265AC4AD47978DAEF8C5482FD30\MSBUILD.NI.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CREDWIZ_31BF3856AD364E35_6.1.7600.16385_NONE_FBCFA2528586252F\CREDWIZ.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..CSENGINE-NATIVEHOST_31BF3856AD364E35_6.1.7600.16385_NONE_761AD65676427BD9\SDIAGNHOST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\EHEXTHOST32\C899DE3549784161AA66610D5735E4F0\EHEXTHOST32.NI.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IIS-SHAREDLIBRARIES_31BF3856AD364E35_6.1.7601.17514_NONE_6F0F7833CB71E18D\ASPNETCA.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TASKMGR_31BF3856AD364E35_6.1.7601.17514_NONE_7288349CBFD37B08\TASKMGR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FONTVIEW_31BF3856AD364E35_6.1.7600.16385_NONE_A058FEE6D0280CAB\FONTVIEW.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SHAREDFOLDERSUI_31BF3856AD364E35_6.1.7600.16385_NONE_1412267F4B3BB985\SHRPUBW.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..YSTEMASSESSMENTTOOL_31BF3856AD364E35_6.1.7601.17514_NONE_D9BAFD47CDF9833B\WINSAT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MOUNTVOL_31BF3856AD364E35_6.1.7600.16385_NONE_0E4E6B146B2452A9\MOUNTVOL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RASAUTODIAL_31BF3856AD364E35_6.1.7600.16385_NONE_6BCEF05D7F04260A\RASAUTOU.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURESTARTUP-SERVICE_31BF3856AD364E35_6.1.7600.16385_NONE_C09AA5B3BEC88BEB\BDEUISRV.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-CSHARP_COMPILER_CSC_B03F5F7F11D50A3A_6.1.7600.16385_NONE_8B52BB03D4EA5D36\CSC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ION-TELEMETRY-AGENT_31BF3856AD364E35_6.1.7601.17514_NONE_3092574C7D41010B\AITAGENT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ES-AUTHENTICATION_31BF3856AD364E35_6.1.7600.16385_NONE_9DB1AE483049E160\EHSTORAUTHN.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IPCONFIG_31BF3856AD364E35_6.1.7600.16385_NONE_A82EE2A7319FA8F8\IPCONFIG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MIGRATIONENGINE_31BF3856AD364E35_6.1.7601.17514_NONE_B6CDDD21F1DF8715\MIGHOST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..G-XPSDOCUMENTWRITER_31BF3856AD364E35_6.1.7601.17514_NONE_80FEA45979A5D3F2\MXDWGC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea972afe8b5d6b3ee52911dca8535050N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea972afe8b5d6b3ee52911dca8535050N.exe"C:\Users\Admin\AppData\Local\Temp\ea972afe8b5d6b3ee52911dca8535050N.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2796