Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 00:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ce28a2b344ded2596c4337a1f6fafb0N.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
120 seconds
General
-
Target
7ce28a2b344ded2596c4337a1f6fafb0N.exe
-
Size
92KB
-
MD5
7ce28a2b344ded2596c4337a1f6fafb0
-
SHA1
da4210616efe00cb545cf6a1362fefae74fe0a52
-
SHA256
fd531019be77ad8c462a99c4ee15eb34922fbd77d9abfcfc23a72d6adb9d940e
-
SHA512
e34c9efc59382715d73c9af52d5aad39d26f8c416a6e0217259f3b766ca9383de54ecb20c1134a182850eb9e9b8458eb3c71bd78ee35f8a973f1c16a488fc698
-
SSDEEP
1536:/JvJnBpwdaMIOOnToIfiV6pdQcTUgab9oOLo:/JvxKaCqTBfiooXgU9oOL
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\XWIZARD.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\RELOG.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\WOWREG32.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\ROUTE.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\WIMSERV.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\DCOMCNFG.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\SETHC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\WLANEXT.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\ODBCAD32.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\RRINSTALLER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\SEARCHFILTERHOST.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\SETIEINSTALLEDDATE.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\WERFAULT.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\CHARMAP.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\WINRS.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\AUTOFMT.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\ESENTUTL.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\NET.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\PERFMON.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\MCBUILDER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\MSRA.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\CMD.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\HELP.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\DVDPLAY.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC10\IMTCPROP.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\FLTMC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\CHOICE.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\HELP.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\SC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\FIND.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\NETIOUGC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\DOSKEY.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\HDWWIZ.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\NET1.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\BTH.INF_AMD64_NEUTRAL_E54666F6A3E5AF91\FSQUIRT.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\ESENTUTL.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMESC5\IMSCPROP.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\REGINI.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\MSRA.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\ATTRIB.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\GPUPDATE.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\BTHUDTASK.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\DIANTZ.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\EXPLORER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\MRINFO.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL_ISE.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\PERFMON.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\USERINIT.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\W32TM.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\DNSCACHEUGC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\SECINIT.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\SRDELAYED.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\MMC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\PCAUI.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\SFC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\SUBST.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\EVENTCREATE.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\MFPMP.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\TCPSVCS.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\PUSHPRINTERCONNECTIONS.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\RPCPING.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SysWOW64\BITSADMIN.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\PACK200.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\PPTICO.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IELOWUTIL.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\OARPMANY.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\BCSSYNC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\EXCEL.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS SIDEBAR\SIDEBAR.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\CHESS\CHESS.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPENC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSTORE.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATECORE.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGIN-CONTAINER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UPDATER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WABMIG.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVA-RMI.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PRIVATE_BROWSING.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\IECONTENTSERVICE.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\INSTALLER\CHRMSTP.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\NATIVE2ASCII.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACROBROKER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\SETUP FILES\{AC76BA86-7AD7-1033-7B44-A90000000001}\SETUP.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSACCESS.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\SETLANG.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\PACK200.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\KINIT.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\POWERPNT.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\INSTALLER\SETUP.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MULTIPLAYER\BACKGAMMON\BCKGZM.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTA\8.0\X86\VSTA_EP32.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\1033\ONELEV.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\LIB\LAUNCHER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\HEARTS\HEARTS.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\ONENOTEM.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\DVD MAKER\DVDMAKER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\LICLUA.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPDMC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\TEXTCONV\WKSCONV\WKCONV.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSOHTMED.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\WORDICON.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WAB.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JP2LAUNCHER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWS PHOTO VIEWER\IMAGINGDEVICES.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSPUB.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\SSVAGENT.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\PIPANEL.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\CONVERTINKSTORE.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\WSIMPORT.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE AIR\VERSIONS\1.0\ADOBE AIR APPLICATION INSTALLER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\POLICYTOOL.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\A3DUTILITY.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVAWS.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVAWS.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNETWK.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACRORD32.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATEONDEMAND.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\EXTEXPORT.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JABSWITCH.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JSTACK.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSTORDB.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WABMIG.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\RMIREGISTRY.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\IDLJ.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\WFSERVICESREG.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MAPI_31BF3856AD364E35_6.1.7601.17514_NONE_097346BE305F3966\FIXMAPI.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WINVER_31BF3856AD364E35_6.1.7600.16385_NONE_12466FE3B629E036\WINVER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGSVCS.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..-EXPERIENCE-APPHELP_31BF3856AD364E35_6.1.7600.16385_NONE_DDF6CB6D7A745CBF\PCAUI.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\SERVICING\GC64\TZUPD.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COM-SURROGATE_31BF3856AD364E35_6.1.7600.16385_NONE_A018E05D0D33081D\DLLHST3G.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-GC-REGISTERIEPKEYS_31BF3856AD364E35_8.0.7601.17514_NONE_A0C922C3B170DD5D\REGISTERIEPKEYS.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-VAULT_31BF3856AD364E35_6.1.7600.16385_NONE_4D5E025E54BA15F8\VAULTSYSUI.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SRDELAYED_31BF3856AD364E35_6.1.7600.16385_NONE_B252497A75D8A174\SRDELAYED.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CSC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\NOTEPAD.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SXS_31BF3856AD364E35_6.1.7601.17514_NONE_0C72A18B6E43457B\SXSTRACE.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\VBC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..LLERCOMMANDLINETOOL_31BF3856AD364E35_6.1.7600.16385_NONE_D0632CBFEE5DB937\SC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-SETUP-SUPPORT_31BF3856AD364E35_8.0.7601.17514_NONE_3EB101CAEC1ACC2C\IE4UINIT.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETUPAPI_31BF3856AD364E35_6.1.7601.17514_NONE_931B5F1FDCDD6496\WOWREG32.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSBUILD.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..UTERMANAGERLAUNCHER_31BF3856AD364E35_6.1.7600.16385_NONE_EA0A643B0E032C19\COMPMGMTLAUNCHER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IIS-SHAREDLIBRARIES_31BF3856AD364E35_6.1.7601.17514_NONE_6F0F7833CB71E18D\IISRESET.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NFS-ADMINCMDTOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_12D42225A9A7AEF7\NFSADMIN.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SONIC-SBESERVER_31BF3856AD364E35_6.1.7601.17514_NONE_7B380CB06FD9D81D\SBESERVER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..OMMAND-LINE-UTILITY_31BF3856AD364E35_6.1.7600.16385_NONE_FD9EC705E687F8C2\WMIC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\EXPLORER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGTLIBV12.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-GROUPPOLICY-SCRIPT_31BF3856AD364E35_6.1.7600.16385_NONE_C10C2A29895D4994\GPSCRIPT.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RELIABILITY-POSTBOOT_31BF3856AD364E35_6.1.7600.16385_NONE_A9B5C1D91F03E0B4\RELPOST.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SCTASKS_31BF3856AD364E35_6.1.7601.17514_NONE_E8657D02CBF5E4C1\SCHTASKS.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WPD-SHELLEXTENSION_31BF3856AD364E35_6.1.7601.17514_NONE_6F4EF219DD693CA6\WPDSHEXTAUTOPLAY.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_REGASM_B03F5F7F11D50A3A_6.1.7601.17514_NONE_A3C349B4BDAC0898\REGASM.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSBUILD\F4A88265AC4AD47978DAEF8C5482FD30\MSBUILD.NI.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\MICROSOFT.WORKFLOW.COMPILER\V4.0_4.0.0.0__31BF3856AD364E35\MICROSOFT.WORKFLOW.COMPILER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..UNTERINFRASTRUCTURE_31BF3856AD364E35_6.1.7600.16385_NONE_CD7AEEFF1897D018\LODCTR.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETUP-COMPONENT_31BF3856AD364E35_6.1.7601.17514_NONE_905283BDC3E1D2D8\SETUP.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_6.1.7601.17514_NONE_90ECF919657DACF4\ARP.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_SUBSYSTEM-FOR-UNIX-BASED-APPLICATIONS_31BF3856AD364E35_6.1.7601.17514_NONE_D20E5D35068F261A\PSXRUN.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSBUILD\AF28543D9B3E7D9F110448ECCE53CD72\MSBUILD.NI.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MSBUILD\1A154709CDFE214029EA88C51AB2B579\MSBUILD.NI.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\DFSVC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CVTRES.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..OPERTIESPERFORMANCE_31BF3856AD364E35_6.1.7600.16385_NONE_B6CB9ED71C8B43D5\SYSTEMPROPERTIESPERFORMANCE.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RASCONNECTIONMANAGER_31BF3856AD364E35_6.1.7601.17514_NONE_BD4644E077251730\CMSTP.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..COMMANDLINETOOLSMQQ_31BF3856AD364E35_6.1.7600.16385_NONE_851E6308C5B62529\MSG.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WAITFOR_31BF3856AD364E35_6.1.7600.16385_NONE_125AA78894E49F8F\WAITFOR.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WCF-COMSVCCONFIG_B03F5F7F11D50A3A_6.1.7601.17514_NONE_52DB65A773B633FD\COMSVCCONFIG.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CSC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..-DIAGNOSTIC-RESULTS_31BF3856AD364E35_6.1.7600.16385_NONE_84DB2473005C51CB\MDRES.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MSINFO32-EXE-COMMON_31BF3856AD364E35_6.1.7601.17514_NONE_E46B048A01806891\MSINFO32.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PACKAGEMANAGER_31BF3856AD364E35_6.1.7601.17514_NONE_4AFDC98B09E3CFE8\PKGMGR.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EHOME-SERVICES-EHSCHED_31BF3856AD364E35_6.1.7600.16385_NONE_0167F08155BF1C81\EHSCHED.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..ETEXPLORER-OPTIONAL_31BF3856AD364E35_11.2.9600.16428_NONE_7B0D6F67C2D3F97A\IEXPLORE.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..COMMANDLINETOOLSMQQ_31BF3856AD364E35_6.1.7600.16385_NONE_851E6308C5B62529\QUSER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_6.1.7601.17514_NONE_90ECF919657DACF4\NETSTAT.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CALC_31BF3856AD364E35_6.1.7600.16385_NONE_05B2F2E2346CFEA4\CALC.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EHOME-EHTRAY_31BF3856AD364E35_6.1.7601.17514_NONE_88FF132E83A8A275\EHTRAY.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..-ODBC-ADMINISTRATOR_31BF3856AD364E35_6.1.7600.16385_NONE_A044D905576812D4\ODBCAD32.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TAPICORE_31BF3856AD364E35_6.1.7600.16385_NONE_402ECA316047A0FE\DIALER.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..PWINDOWMANAGER-CORE_31BF3856AD364E35_6.1.7601.17514_NONE_EBC99983D3D18578\DWM.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..I_INITIATOR_SERVICE_31BF3856AD364E35_6.1.7601.17514_NONE_3899B0AD2BB77A86\ISCSICLI.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\INSTALLER\{90140000-0011-0000-0000-0000000FF1CE}\WORDICON.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SHUTDOWN-EVENT-TRACKER_31BF3856AD364E35_6.1.7600.16385_NONE_5EC90957E1A8FE95\SHUTDOWN.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SMSVCHOST\0B4D4E172E8054CB61D27F5AB9E0E445\SMSVCHOST.NI.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..NG-SPOOLER-SPLWOW64_31BF3856AD364E35_6.1.7601.17514_NONE_25D05769A8973724\SPLWOW64.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..ESTARTUP-FVERECOVER_31BF3856AD364E35_6.1.7600.16385_NONE_AB0552BCEECA5A61\BDEUNLOCKWIZARD.EXE 7ce28a2b344ded2596c4337a1f6fafb0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ce28a2b344ded2596c4337a1f6fafb0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ce28a2b344ded2596c4337a1f6fafb0N.exe"C:\Users\Admin\AppData\Local\Temp\7ce28a2b344ded2596c4337a1f6fafb0N.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2860