Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe
-
Size
9.6MB
-
MD5
c0564b68734ba347816a60f257f65a00
-
SHA1
77b8bd5f2099defce01cbe1658aedc85aa5f896e
-
SHA256
2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788d
-
SHA512
7335c5a1abdfd4284d1aaf8ec4cdee130e221d1cb3ee3ea01cf45b0336277c6e3c0f458a3f3ae0f99a554650b33562940508573c85613a185f1ce0a77009c266
-
SSDEEP
196608:V7qnhgJuP3LAhCiVX5WvrOA1oMuWr45hrr2S:uS+Le+eJWGhrr2S
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OneDriveSetupOneDrive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe" 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftOneDriveSetup26962 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe" 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\SysWOW64\migration\de-DE\BetriebssystemMicrosoft.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Windows\SysWOW64\migration\de-DE\RCX341A.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe -
Drops file in Program Files directory 37 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LibraryUtilities.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AcrobatAiod.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMReader1.824.29.8644.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_81359\javajavaws8.0.3810.9.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\RCX897B.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX91EA.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\ApplicationsStudio.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LinkDirectX.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_81359\RCX7F85.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\AdobeNPPDF32.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCX99BC.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\ApplicationsStudio.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\msdaorarsqlxmlx.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ReaderLogTransport27.1.1.3403.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ReaderLogTransport27.1.1.3403.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHostAdobe.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AdobeAcrobat.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX7E4B.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMReader1.824.29.8644.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX7ED9.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHostAdobe.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\RCX9268.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_81359\javajavaws8.0.3810.9.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\FlashFlash19.10.20064.310990.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\NPPDF32Adobe.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\RCX90DF.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\RCX767A.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LinkDirectX.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\AdobeAcrobat.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCXA21A.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX9AA7.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\RCX74E2.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Common Files\System\ado\es-ES\MicrosoftWindows.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\RCX88DE.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LibraryUtilities.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\es-ES\RCX75EC.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\RCX8860.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\dataFramework.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..providers.resources_31bf3856ad364e35_10.0.19041.1_de-de_21e45e3360add1aa\IntlProviderSystem.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-driver.resources_31bf3856ad364e35_10.0.19041.1_de-de_960441df72cd8038\tcpipBetriebssystem.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4980aca4fc783f0e\CertCliOperating.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..-servicehostbuilder_31bf3856ad364e35_10.0.19041.1_none_e487e1faebcc7c5f\MicrosoftOperating.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\RCX3564.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..nputpanel.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ec2af9702de558f3\TipResTabTip32.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..on-client.resources_31bf3856ad364e35_10.0.19041.1_es-es_693b6b5b68a14bf6\operativoWindows.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..vider-rll.resources_31bf3856ad364e35_10.0.19041.1_it-it_fb093f6dbd39de41\Windowsoperativo.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..erclasses.resources_31bf3856ad364e35_10.0.19041.1_es-es_ac74ffe2ddda5824\paraSMBHelperClass.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CertificateServices.PKIClient.Cmdlets.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\Windowsresources10.0.19041.1.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\RCX185.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\msil_system.drawing.design.resources_b03f5f7f11d50a3a_10.0.19041.1_fr-fr_7356358c700944b1\resourcesSystem2.0.50727.9149.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Cmdletization.OData.Resources\v4.0_3.0.0.0_fr_31bf3856ad364e35\RCX79C2.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webservices_31bf3856ad364e35_10.0.19041.1_none_c46d65bcce0fc64d\OperatingMicrosoft.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_10.0.19041.1151_en-us_ececcfbf6bb1cf51\SystemWindows.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..ingengine.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_7d9f16b54f3b745f\Windowsdexploitation.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-enhancedvideorenderer_31bf3856ad364e35_10.0.19041.1_none_45938b2f6be4058f\EnhancedVideo.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..acysnapin.resources_31bf3856ad364e35_10.0.19041.1_it-it_fa1b38e5fc197cc5\InternetInternet10.0.19041.1.160101.0800.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\ja-JP\RCX32C.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-feedsbs.resources_31bf3856ad364e35_11.0.19041.1_fr-fr_78c0ae571d0957fb\Explorermsfeedsbs.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..tservices.resources_31bf3856ad364e35_10.0.19041.1_it-it_5e5273bce6264a6e\operativoWindows.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Windows\Fonts\RCX475.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\RCX78B8.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\Boot\EFI\et-EE\WindowsMicrosoft.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\Boot\PCAT\fr-FR\bootmgrbootmgr.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\Fonts\OEMFONTSFONTS.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-windowscodecraw_31bf3856ad364e35_10.0.19041.1165_none_09c62bea6ce5a482\OperatingMicrosoftRawCodec.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..orkaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_bd9990a0c98c5e01\MicrosoftWindows.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..s-sessionenvservice_31bf3856ad364e35_10.0.19041.964_none_bcc003ba46884d04\SessEnvSystem10.0.19041.964.160101.0800.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\RCXBCE9.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\SystemRuntime.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\Boot\Resources\de-DE\bootresbootres.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.746_none_58702f801199ce06\SystemWindows.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_8636783e05df6f4e\Systemnewdev.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msvideodsp_31bf3856ad364e35_10.0.19041.746_none_ad89793cfc7e4a0b\StabilizationVideo.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Cmdletization.OData.Resources\v4.0_3.0.0.0_fr_31bf3856ad364e35\ODatadexploitation10.0.19041.1.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-time-ptp-provider_31bf3856ad364e35_10.0.19041.1_none_37f24426b8e31159\WindowsPtpProv.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations.Resources\3.5.0.0_it_31bf3856ad364e35\RCX34C7.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\Boot\EFI\fr-FR\MicrosoftWindows.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..shape-rll.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bc3dc3ee720bb7bd\msaddsrOperating.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..trolpanel.resources_31bf3856ad364e35_10.0.19041.1_de-de_afc2fe4d55ec7c97\SpaceControlBetriebssystem10.0.19041.1.160101.0800.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CertificateServices.PKIClient.Cmdlets.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\RCX7A8E.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations.Resources\3.5.0.0_it_31bf3856ad364e35\resourcesFramework.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorerframe_31bf3856ad364e35_10.0.19041.1023_none_41a96a435d5614dd\MicrosoftExplorerFrame.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\MicrosoftWindows.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\it-IT\FrameworkPresentationHostDll3.0.6920.91356.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..mon-printexperience_31bf3856ad364e35_10.0.19041.746_none_7f8ee0379cb19113\WindowsSystem.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pprovider.resources_31bf3856ad364e35_10.0.19041.1_es-es_41e0d1946a7c5321\Provideroperativo.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\WPF\it-IT\RCXBD57.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-profapi-onecore_31bf3856ad364e35_10.0.19041.1_none_c6623aa94aace07f\WindowsPROFAPI10.0.19041.1.160101.0800.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performance.resources_31bf3856ad364e35_10.0.19041.1_es-es_fc6fda80b746ca05\operativoSystemPropertiesPerformance.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ellextensionhandler_31bf3856ad364e35_10.0.19041.1_none_d283db7942af6e40\ms3dthumbnailproviderMicrosoft.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ting-spooler-client_31bf3856ad364e35_10.0.19041.1288_none_124a46fb023e4e9a\OperatingSystem.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_system.windows.presentation_b77a5c561934e089_4.0.15805.0_none_633c02ffa149a699\PresentationSystem.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..llers-onecore-extra_31bf3856ad364e35_10.0.19041.1220_none_3c7e82b7c00fd08e\sppinstMicrosoft.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\ja-JP\PresentationHostv0400PresentationHostv0400.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..leshooter.resources_31bf3856ad364e35_10.0.19041.1_en-us_63658bc7d0565b87\Windowswhealogr.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wwansvc.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_0b679f36bac0ef8f\WwanSvcWwanSvc.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..extension.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ff1e449e917fa168\MicrosoftWindows.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kexplorer.resources_31bf3856ad364e35_10.0.19041.1_de-de_9f27e48c0c9bdc51\WindowsWindows.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\MicrosoftWindows4.8.4084.0.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\RCXBC8A.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Windows\Boot\PCAT\nb-NO\bootmgrWindows.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 3312 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe"C:\Users\Admin\AppData\Local\Temp\2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3312
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.6MB
MD582ba5abd40101926379116dcedbb1003
SHA173804651c8e4520df8ebf5bdae8871c798db9fa3
SHA256da62755b25b1643b8f9f055119967dd77d40c3a47b47f7db2d686034be10ed45
SHA512495e3665b8dfe6c57114c820c0e3e9e978706a027c8159658825cdbf87423315927bdf31db09be6f387b14e3359ef4aef0d39d518ab795d5c2bbea6b992d8a8d
-
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\ApplicationsStudio.exe
Filesize9.6MB
MD5c0564b68734ba347816a60f257f65a00
SHA177b8bd5f2099defce01cbe1658aedc85aa5f896e
SHA2562ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788d
SHA5127335c5a1abdfd4284d1aaf8ec4cdee130e221d1cb3ee3ea01cf45b0336277c6e3c0f458a3f3ae0f99a554650b33562940508573c85613a185f1ce0a77009c266
-
Filesize
9.7MB
MD5a9d5009d0637fa218655b1f2f06a0650
SHA19f1faca0d2b5e0868539f5893de46cbdc306a81e
SHA2568269f7d0b08582ccbebd59f7b397a6f2f4cf55ddc71155268b4627637ace0993
SHA512d84450c38c180f5c936daf752372bbbca4645e65b34da5c7c2944b2c976286defeeac3f6a4744c31aafc8c910bda05799dc28843564526b7115b9f3b815ae931
-
C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations.Resources\3.5.0.0_it_31bf3856ad364e35\resourcesFramework.exe
Filesize9.7MB
MD53407edc97d3a31e203ddc4689963c3e8
SHA1702e7d0d88d1196036371e03fd9e645090e4566d
SHA2569cb7d58cc306fec2620675a5917e77dabcc646371fcc780e2f3676e4fe4090f0
SHA5123da6a7e6cb52d405fa280731ca12f50c2631fc2ec2442970bf77d6beaaf160e53b1251fa190e2b5629e73f2e63d54dc43e7f10379ff2e05494a7e515f7b20e80