Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 01:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e4f101f59ab8b3923b7266915ac52cb0N.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
120 seconds
General
-
Target
e4f101f59ab8b3923b7266915ac52cb0N.exe
-
Size
63KB
-
MD5
e4f101f59ab8b3923b7266915ac52cb0
-
SHA1
90311c579cc578a43097255d707cb02dbefdb755
-
SHA256
23536e667239c0b531be4667caecb04f4eec7962be4bfb05d8406668dfe3cefa
-
SHA512
ef19637b56ba7d23870f8f9efff9d58780140ca661bb708726a695b7145cd1e186487f7d0ab070aca40c6468c9794f61351eb44ed3d60a6599451241075fc4c4
-
SSDEEP
768:EcENCjdJIO4VBafkABbXSPo5mR/TWbxYLMCnWvhgpgrElT0lYioRojXq5FZ:EcVEO0R/PgYgrElJojOZ
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\CMDKEY.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\EXPAND.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\GRPCONV.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\MSPAINT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\NETBTUGC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\NEWDEV.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\RUNAS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL_ISE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\CHKNTFS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\COMPUTERDEFAULTS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\PRINT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\RUNLEGACYCPLELEVATED.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPROTECTION.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\WINRSHOST.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\WWAHOST.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\DXDIAG.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMECFMUI.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\MMGASERVER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_SSP.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMUWPLAUNCHER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\VERIFIERGUI.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\BITSADMIN.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\NOTEPAD.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\REAGENTC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\REKEYWIZ.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\SECINIT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\TASKMGR.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\UTILMAN.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\FSUTIL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\MOBSYNC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\SFC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\WERFAULT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\AT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\CACLS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\DCOMCNFG.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\DOSKEY.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\MAKECAB.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\MSIEXEC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\WSMPROVHOST.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\DWWIN.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\FORFILES.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPUEXC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\NET.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\REPLACE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\USERACCOUNTCONTROLSETTINGS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\CLICONFG.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\CREDWIZ.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\FTP.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\HH.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\ICACLS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC\IMTCPROP.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\LOGMAN.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\REGISTER-CIMPROVIDER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\ISCSICPL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\MTSTOCOM.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\REGINI.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHFILTERHOST.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\TIMEOUT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\APPIDTEL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\CMSTP.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\DISKPART.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SysWOW64\PASSWORDONWAKESETTINGFLYOUT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVSHNOTIFY.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SSVAGENT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-006E-0409-1000-0000000FF1CE}\MISC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTOFFICEHUB_18.1903.1152.0_X64__8WEKYB3D8BBWE\LOCALBRIDGE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16005.11629.20316.0_X64__8WEKYB3D8BBWE\HXTSR.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVAWS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JJS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KINIT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\RMID.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\DW\DW20.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\MSOXMLED.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DISABLEDGOOGLEUPDATE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\INSTALL\{95408F56-EF00-410C-B74C-E876227BF0D5}\CHROME_INSTALLER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\123.0.6312.123\ELEVATION_SERVICE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JPS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\COOKIE_EXPORTER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\POLICYTOOL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.LOADER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UPDATER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.549981C3F5F10_1.1911.21713.0_X64__8WEKYB3D8BBWE\WIN32BRIDGE.SERVER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\LOGTRANSPORT2.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\RMIC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\TNAMESERV.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IELOWUTIL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\GRV_ICONS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROCEF\RDRCEF.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SCREENSKETCH_10.1907.2471.0_X64__8WEKYB3D8BBWE\SCREENSKETCH.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\TNAMESERV.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\PACK200.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\PACK200.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.371\GOOGLECRASHHANDLER64.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION_4.4.8204.0_X64__8WEKYB3D8BBWE\SOLITAIRE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WEBMEDIAEXTENSIONS_1.0.20875.0_X64__8WEKYB3D8BBWE\MICROSOFT.WEBMEDIAEXTENSIONS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JHAT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTACK.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WAB.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WABMIG.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\XJC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.NETFX40.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\FLTLDR.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UNINSTALL\HELPER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\OFFICEAPPGUARDWIN32.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\WORDICON.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\MSEDGEWEBVIEW2.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\EXCELCNV.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\PJ11ICON.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOEV.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROBROKER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\PLUG_INS\PI_BROKERS\32BITMAPIBROKER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\MICROSOFTEDGEUPDATE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MOZILLA MAINTENANCE SERVICE\UNINSTALL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JCMD.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\ORBD.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOASB.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\POWERPNT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\MISC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.GETSTARTED_8.2.22942.0_X64__8WEKYB3D8BBWE\FMUI\FMUI.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\TABTIP32.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\SCHEMAGEN.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KLIST.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WPF\XAMLVIEWER\XAMLVIEWER_V0300.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\SMSVCHOST.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\DFSVC\2.0.0.0__B03F5F7F11D50A3A\DFSVC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_REGBROWSERS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_STATE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINUTIL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.CALLINGSHELLAPP_CW5N1H2TXYEWY\CALLINGSHELLAPP.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\PRESENTATIONFONTCACHE\3.0.0.0__31BF3856AD364E35\PRESENTATIONFONTCACHE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4BITMAPIBROKER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\APPLAUNCH.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\INSTALLUTIL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\PARENTALCONTROLS_CW5N1H2TXYEWY\WPCUAPAPP.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_STATE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ILASM.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGASM.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_REGSQL_B03F5F7F11D50A3A_4.0.15805.0_NONE_AADF84CDA75DA02D\ASPNET_REGSQL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_32\MSBUILD\3.5.0.0__B03F5F7F11D50A3A\MSBUILD.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_COMPILER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DFSVC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WPF\PRESENTATIONFONTCACHE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_WP.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.SECUREASSESSMENTBROWSER_CW5N1H2TXYEWY\SECUREASSESSMENTBROWSER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\DATASVCUTIL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CVTRES.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SERVICEMODELREG.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.CREDDIALOGHOST_CW5N1H2TXYEWY\CREDDIALOGHOST.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CASPOL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CASPOL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.BIOENROLLMENT_CW5N1H2TXYEWY\BIOENROLLMENTHOST.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\SMSVCHOST\3.0.0.0__B03F5F7F11D50A3A\SMSVCHOST.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_REGIIS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INPUTAPP\TEXTINPUTHOST.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCORSVW.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\BOOT\PCAT\MEMTEST.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_WP.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NGENTASK.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\INSTALLUTIL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMSVCHOST.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\HELPPANE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_COMPILER_B03F5F7F11D50A3A_10.0.19041.1_NONE_9202844CD514AB44\ASPNET_COMPILER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\RDRSERVICESUPDATER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\JSC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DFSVC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.SEARCH_CW5N1H2TXYEWY\SEARCHAPP.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\WSATCONFIG\V4.0_4.0.0.0__B03F5F7F11D50A3A\WSATCONFIG.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\REGSVCS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CSC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\COMSVCCONFIG.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\CSC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_DATASVCUTIL_B77A5C561934E089_4.0.15805.0_NONE_5B1ADA239E3B0505\DATASVCUTIL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_64\MSBUILD\3.5.0.0__B03F5F7F11D50A3A\MSBUILD.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ACRORD32INFO.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\APPLAUNCH.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGSVCS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SERVICING\TRUSTEDINSTALLER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\SPLWOW64.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\BITLOCKERDISCOVERYVOLUMECONTENTS\BITLOCKERTOGO.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ADDINPROCESS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINPROCESS32.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_STATE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\WSATCONFIG.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\MICROSOFT.WORKFLOW.COMPILER\V4.0_4.0.0.0__31BF3856AD364E35\MICROSOFT.WORKFLOW.COMPILER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WSATCONFIG.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e4f101f59ab8b3923b7266915ac52cb0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4f101f59ab8b3923b7266915ac52cb0N.exe"C:\Users\Admin\AppData\Local\Temp\e4f101f59ab8b3923b7266915ac52cb0N.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4396