Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08-09-2024 02:36
Behavioral task
behavioral1
Sample
cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe
-
Size
1.1MB
-
MD5
b6f74448014cecdb8caee3fedb3495d4
-
SHA1
b9e8e44c15e176ee2b4aaac4f00b0b53ed0e03ce
-
SHA256
cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918
-
SHA512
4b4ee28bb4416882c66ea4b81722fdd1033c6868f7557c32b292893f8ac02ca65f07d1102e1063fcc6b0ae5f11a0be72accacbc4093ceda4fc0d8d5c88b3f1fd
-
SSDEEP
24576:jToaG6si/64FqsNBM/9/fwK/FTwfCBM0VZeg15:jT5sLsNBk9/fw2BwfmM0fV
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x0009000000016c7c-8.dat aspack_v212_v242 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\sc.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\upnpcont.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\efsui.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\raserver.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIADAP.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\regini.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\doskey.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\osk.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\where.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\wlanext.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\convert.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\gpresult.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\odbcad32.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\msdt.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\printui.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\sdchange.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\dvdplay.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\LocationNotifications.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\proquota.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\sbunattend.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\taskkill.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\typeperf.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\whoami.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\wuapp.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\wbem\mofcomp.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\secinit.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\InstallShield\_isdel.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\resmon.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\rdrleakdiag.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\syskey.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\timeout.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\userinit.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\WerFaultSecure.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\mshta.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\Robocopy.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\RpcPing.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\cttune.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setup.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\help.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\rundll32.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\runonce.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\sfc.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\com\MigRegDB.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\imjppdmg.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\SecEdit.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\wbem\WinMgmt.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\icsunattend.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\ndadmin.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesHardware.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\ipconfig.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\msinfo32.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\SysWOW64\calc.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files\Java\jre7\bin\java.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\7-Zip\7zG.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files\7-Zip\7zFM.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_6.1.7600.16385_none_1ddb4b87a6618437\chkdsk.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-cipher_31bf3856ad364e35_6.1.7600.16385_none_090b7101bec9a9e2\cipher.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehmsas_31bf3856ad364e35_6.1.7600.16385_none_8707c620868fdf75\ehmsas.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-help-client_31bf3856ad364e35_6.1.7600.16385_none_c80d81c947c7b794\HelpPane.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-rpc-locator_31bf3856ad364e35_6.1.7600.16385_none_2b2984d40648fbe7\Locator.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-taskhost_31bf3856ad364e35_6.1.7601.18010_none_86608c5a70f925bc\taskhost.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_9da1b3254ff796e9\sdchange.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_ef38a8d0d05cc2c7\IMJPDADM.EXE cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-fdddo_31bf3856ad364e35_6.1.7600.16385_none_b0de2afe4ca7a1e2\DeviceDisplayObjectProvider.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_6.1.7600.16385_none_ff7cf696bfb54620\ucsvc.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_6.1.7601.17514_none_7d0125c85cc31d2a\rdpinit.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-cipher_31bf3856ad364e35_6.1.7600.16385_none_acecd57e066c38ac\cipher.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24\ndadmin.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7600.16385_none_5702948e8e63fc30\wecutil.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-getmac_31bf3856ad364e35_6.1.7600.16385_none_67f38861bbac1910\getmac.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_6.1.7600.16385_none_d7c180d4bd657495\iscsicpl.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_6.1.7600.16385_none_8945930a7d61b9f0\MigRegDB.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_6.1.7600.16385_none_8be8919a8f43b3f6\raserver.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..erinboxgames-spades_31bf3856ad364e35_6.1.7600.16385_none_6fa6d7361acba514\shvlzm.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_a0cf62efee3228a3\wabmig.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\msil_servicemodelreg_b03f5f7f11d50a3a_6.1.7601.17514_none_1f2918adb8a9c100\ServiceModelReg.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-anytime-upgradeui_31bf3856ad364e35_6.1.7600.16385_none_4aadf3be188c056d\WindowsAnytimeUpgradeui.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_6.1.7600.16385_none_33e01c5875c2e5cb\iscsicpl.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_be8acdd10de3b1a6\netbtugc.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..flicklearningwizard_31bf3856ad364e35_6.1.7600.16385_none_69769fd78b751ad3\FlickLearningWizard.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_9d700972113e2691_wowreg32.exe_94fc2d06 cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\replace.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-s..line-user-interface_31bf3856ad364e35_6.1.7600.16385_none_dcbdc8e83e2b98be\cmdkey.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_11.2.9600.16428_none_0a3fe92b38dd8c45\RegisterIEPKEYs.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-rundll32_31bf3856ad364e35_6.1.7600.16385_none_33fa4336c49b998b\rundll32.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-commandlinehelp_31bf3856ad364e35_6.1.7600.16385_none_d4018bc76a8b37d9\help.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ftp_31bf3856ad364e35_6.1.7601.17514_none_aef2c7dbb6cc16c1\ftp.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_6.1.7600.16385_none_cb9353551bbd8ed8\DevicePairingWizard.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\poqexec.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.16385_none_082f99a432e2a661_smss.exe_d7209c3a cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\print.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.2.9600.16428_none_32a601ad2b7a554f\PDMSetup.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..oxgames-purbleplace_31bf3856ad364e35_6.1.7600.16385_none_622070221822eb39\PurblePlace.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.2.9600.16428_none_828666943772c435\msfeedssync.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_6.1.7600.16385_none_40d0db63344deff9\SystemPropertiesHardware.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\oisicon.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\ehome\mcGlidHost.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe$ cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\wmplayer.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_51bcbc61a5466a58_certenrollctrl.exe_9495aa75 cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-getmac_31bf3856ad364e35_6.1.7600.16385_none_0bd4ecde034ea7da\getmac.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\2bd538d545e15452202ef3b41080e2ce\ComSvcConfig.ni.exe cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2640 cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe"C:\Users\Admin\AppData\Local\Temp\cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5b6f74448014cecdb8caee3fedb3495d4
SHA1b9e8e44c15e176ee2b4aaac4f00b0b53ed0e03ce
SHA256cfd1cc87468f8952f93116ce8a5da1ed0ddf11bc036e07332f2b2a9db65c6918
SHA5124b4ee28bb4416882c66ea4b81722fdd1033c6868f7557c32b292893f8ac02ca65f07d1102e1063fcc6b0ae5f11a0be72accacbc4093ceda4fc0d8d5c88b3f1fd