Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 16:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ea972afe8b5d6b3ee52911dca8535050N.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
General
-
Target
ea972afe8b5d6b3ee52911dca8535050N.exe
-
Size
63KB
-
MD5
ea972afe8b5d6b3ee52911dca8535050
-
SHA1
9c630c96b98522aa1a51542b66425f324256ed75
-
SHA256
e2345ebb1443e5f3e9c884eb8c359c03fcbe31246e7b67029bcef01b870fbde6
-
SHA512
eae0b96fd99e0a34db0e0739bcb932019b99acb468b9d2e2c21ca75b2a5fc058fd635224abd16b4388b8b5698127d8603997c3131f482fb5ff091b6e495c2fc3
-
SSDEEP
768:UcENCjdJIO4VBafkABbXSPo5mR/TWbxYLMCnWvhgpgrElCg0lYioRoPBqnFZ:UcVEO0R/PgYgrEldopIZ
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\ICSUNATTEND.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\SFC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\TAKEOWN.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\EASEOFACCESSDIALOG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\GPSCRIPT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\PERFHOST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\REG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\DCOMCNFG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\NOTEPAD.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\NETCFGNOTIFYOBJECTHOST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC\IMTCPROP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMECFMUI.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\DEVICEPAIRINGWIZARD.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\DISM.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\FONTDRVHOST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\NSLOOKUP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\TASKMGR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\APPIDTEL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\BITSADMIN.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\LAUNCHWINAPP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\ROBOCOPY.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\SCHTASKS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\DVDPLAY.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\FINDSTR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\SETUPUGC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\WERFAULTSECURE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\MOBSYNC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\PERFMON.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\PSR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\REGINI.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_SSP_ISV.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\CSCRIPT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\GAMEBARPRESENCEWRITER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\RDPSAPROXY.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\SETHC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\WSMANHTTPCONFIG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\CIPHER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPUEXC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPDCT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC\IMTCLNWZ.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMEPADSV.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\WAITFOR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\CLICONFG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\DPLAYSVR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\SETUP16.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\TAR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\FONTVIEW.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\RRINSTALLER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\IEUNATT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\NETPLWIZ.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\CALC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\CURL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\WEXTRACT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\WINRSHOST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\MAVINJECT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\PKGMGR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\OPENFILES.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\PROVLAUNCH.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\RECOVER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\SUBST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\UNREGMP2.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\WHERE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\AUTOCONV.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SysWOW64\DDODIAG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\EXCELCNV.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION_4.4.8204.0_X64__8WEKYB3D8BBWE\SOLITAIRE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.OFFICE.ONENOTE_16001.12026.20112.0_X64__8WEKYB3D8BBWE\ONENOTEIM.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICE16\LICLUA.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JABSWITCH.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH\JAVAWS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\MSEDGE_PROXY.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WAB.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IELOWUTIL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVAWS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\DATABASECOMPARE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\DBCICONS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WABMIG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\SETUP_WM.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPSHARE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTOFFICEHUB_18.1903.1152.0_X64__8WEKYB3D8BBWE\LOCALBRIDGE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAWS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH_TARGET_82468\JAVA.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\ARM\1.0\ADOBEARMHELPER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\6.0.27\CREATEDUMP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\RMID.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\COMMON.SHOWHELP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KTAB.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\UNPACK200.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\SERVERTOOL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\NAMECONTROLSERVER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX86\MICROSOFT SHARED\EQUATION\EQNEDT32.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH_TARGET_82468\JAVAW.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOASB.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UNINSTALL\HELPER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.GETSTARTED_8.2.22942.0_X64__8WEKYB3D8BBWE\WHATSNEW.STORE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXGAMEOVERLAY_1.46.11001.0_X64__8WEKYB3D8BBWE\GAMEBAR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROCEF\RDRCEF.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\OFFICEAPPGUARDWIN32.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\RMID.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WAB.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\COOKIE_EXPORTER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVA-RMI.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\PACK200.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE16\OSPPREARM.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWS PHOTO VIEWER\IMAGINGDEVICES.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\EXTEXPORT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS PHOTO VIEWER\IMAGINGDEVICES.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\RMIREGISTRY.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OFFICEC2RCLIENT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE 15\CLIENTX64\OFFICECLICKTORUN.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SKYPEAPP_14.53.77.0_X64__KZF8QXF38ZG5C\SKYPEBRIDGE\SKYPEBRIDGE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.ZUNEVIDEO_10.19071.19011.0_X64__8WEKYB3D8BBWE\VIDEO.UI.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MAVINJECT32.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KLIST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\WORDICON.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SCREENSKETCH_10.1907.2471.0_X64__8WEKYB3D8BBWE\SCREENSKETCH.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXGAMINGOVERLAY_2.34.28001.0_X64__8WEKYB3D8BBWE\GAMEBAR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\MOZILLA MAINTENANCE SERVICE\UNINSTALL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KTAB.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\CLVIEW.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\WORDICON.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\PWAHELPER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KINIT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEINSTAL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CVTRES.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.OOBENETWORKCONNECTIONFLOW_CW5N1H2TXYEWY\OOBENETWORKCONNECTIONFLOW.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_JSC_B03F5F7F11D50A3A_4.0.15805.0_NONE_02D98290C2A0AA6B\JSC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-C..PERIENCEHOST-BROKER_31BF3856AD364E35_10.0.19041.746_NONE_1CE3C0F12FB5F8EC\F\CLOUDEXPERIENCEHOSTBROKER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-I..ATEDUSERMODE-KERNEL_31BF3856AD364E35_10.0.19041.1023_NONE_5C93EF2449C89609\F\SECUREKERNEL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ACROTEXTEXTRACTOR.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\WSATCONFIG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-D..S-VMSWITCH-NETSETUP_31BF3856AD364E35_10.0.19041.264_NONE_62496CAEBA2DAA52\NVSPINFO.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-DRIVERS-HYPERVISOR_31BF3856AD364E35_10.0.19041.1288_NONE_A518F9EB1AB503D0\HVIX64.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-VSTACK-VMMS_31BF3856AD364E35_10.0.19041.264_NONE_1477A882BDCE0DF2\VMMS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-VSTACK-VMWP_31BF3856AD364E35_10.0.19041.1266_NONE_AA0661CC14F9FE9A\R\VMWP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-VSTACK-VMWP_31BF3856AD364E35_10.0.19041.264_NONE_13222F28BEAA00A7\R\VMWP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCORSVW.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ILASM.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\WFSERVICESREG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.CREDDIALOGHOST_CW5N1H2TXYEWY\CREDDIALOGHOST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\SCREENCLIPPING\SCREENCLIPPINGHOST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NGEN.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_REGIIS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\REGASM.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SERVICING\TRUSTEDINSTALLER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\INSTALLUTIL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-DRIVERS-HYPERVISOR_31BF3856AD364E35_10.0.19041.1288_NONE_A518F9EB1AB503D0\R\HVAX64.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DFSVC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\MSBUILD.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\INSTALLUTIL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\REGSVCS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\BITLOCKERDISCOVERYVOLUMECONTENTS\BITLOCKERTOGO.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINUTIL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSBUILD.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADOBE-FLASH-FOR-WINDOWS_31BF3856AD364E35_10.0.19041.82_NONE_2358A116979CC599\FLASHUTIL_ACTIVEX.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-D..S-VMSWITCH-NETSETUP_31BF3856AD364E35_10.0.19041.1288_NONE_F92F7256107C0E35\NVSPINFO.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\COMSVCCONFIG\V4.0_4.0.0.0__B03F5F7F11D50A3A\COMSVCCONFIG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGIIS.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMCONFIGINSTALLER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\DATASVCUTIL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-DRIVERS-HYPERVISOR_31BF3856AD364E35_10.0.19041.264_NONE_0E32F443C4669FED\HVIX64.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMSVCHOST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\EDMGEN.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\VBC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_STATE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\ADDINPROCESS32.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\CSC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ADDINUTIL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.SEARCH_CW5N1H2TXYEWY\SEARCHAPP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\PRESENTATIONFONTCACHE\3.0.0.0__31BF3856AD364E35\PRESENTATIONFONTCACHE.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\EXPLORER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_32\MSBUILD\V4.0_4.0.0.0__B03F5F7F11D50A3A\MSBUILD.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\WSATCONFIG\V4.0_4.0.0.0__B03F5F7F11D50A3A\WSATCONFIG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-ONLINESETUP-COMPONENT_31BF3856AD364E35_10.0.19041.746_NONE_4B0A936D86CDD479\F\WINDEPLOY.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_EDMGEN_B77A5C561934E089_4.0.15805.0_NONE_AE80A3049486A75F\EDMGEN.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-CONT..UTIONSERVICE-SHARED_31BF3856AD364E35_10.0.19041.1_NONE_0BC0F3D4CD7DC8FD\CEXECSVC.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-GUESTCOMPUTESERVICE_31BF3856AD364E35_10.0.19041.264_NONE_6B6699B671C8F5A8\VMCOMPUTEAGENT.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HNS-DIAGNOSTICSTOOL_31BF3856AD364E35_10.0.19041.423_NONE_841C30F68571C385\F\HNSDIAG.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.FILEPICKER_CW5N1H2TXYEWY\FILEPICKER.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NGENTASK.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-CONSOLE-HOST-CORE_31BF3856AD364E35_10.0.19041.153_NONE_4B81B20E830F375B\F\CONHOST.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-ONLINESETUP-COMPONENT_31BF3856AD364E35_10.0.19041.746_NONE_4B0A936D86CDD479\WINDEPLOY.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DATASVCUTIL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.CALLINGSHELLAPP_CW5N1H2TXYEWY\CALLINGSHELLAPP.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_INSTALLUTIL_B03F5F7F11D50A3A_4.0.15805.0_NONE_D67D06EF0C4A2E1C\INSTALLUTIL.EXE ea972afe8b5d6b3ee52911dca8535050N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-DRIVERS-HYPERVISOR_31BF3856AD364E35_10.0.19041.264_NONE_0E32F443C4669FED\HVAX64.EXE ea972afe8b5d6b3ee52911dca8535050N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea972afe8b5d6b3ee52911dca8535050N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea972afe8b5d6b3ee52911dca8535050N.exe"C:\Users\Admin\AppData\Local\Temp\ea972afe8b5d6b3ee52911dca8535050N.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2400