Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 02:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
120 seconds
General
-
Target
782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe
-
Size
52KB
-
MD5
68fd9d42e61c9c7c4e9ccb557068b4f0
-
SHA1
2adf9f47d9a5128d2c3b1a43146d42c3c66fc0d8
-
SHA256
782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8c
-
SHA512
c4e05df4a4cfbadafb038f211df316a1cf586de9db0755ab0b7c1490fe66513bb783eb18f9e353dd65949ee51c1abcd9622f2ca696740a1c0bc967dad435ab60
-
SSDEEP
768:FlQ4hrvaEGU4aikqykezg2XpfY9jYioRoNFYl5:fLhE1Dezg2ZfYUoPO5
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\P: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\R: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\V: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\Y: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\Z: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\H: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\L: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\M: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\U: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\X: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\K: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\N: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\S: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\T: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\Q: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\W: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\E: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\G: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\I: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\J: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\CTTUNESVR.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\EUDCEDIT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\ODBCAD32.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\MIGWIZ\POSTMIG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\SFC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\USER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\CMDKEY.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\LOGMAN.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\MIGAUTOPLAY.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\DISM\DISMHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\ICACLS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\REAGENTC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\RUNONCE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\SETX.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\BTH.INF_AMD64_NEUTRAL_E54666F6A3E5AF91\FSQUIRT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\EXTRAC32.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\INFDEFAULTINSTALL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHFILTERHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\SORT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\RMACTIVATE_ISV.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\INSTALLSHIELD\_ISDEL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\MSDT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\CERTUTIL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\REGSVR32.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\OCSETUP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\RRINSTALLER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\MAGNIFY.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\TCMSETUP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\W32TM.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\SHRPUBW.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\WINRSHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\COMPUTERDEFAULTS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\IME\IMEJP10\IMJPMGR.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\RMCLIENT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\TIMEOUT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\AT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\CONVERT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\DNSCACHEUGC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESCOMPUTERNAME.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\DEVICEPAIRINGWIZARD.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\NAPSTAT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\PKGMGR.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\RASPHONE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\REG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\WERFAULT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\RDRLEAKDIAG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESREMOTE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\WOWREG32.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\OPENFILES.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\TAKEOWN.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\WERMGR.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\MAGNIFY.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\MSHTA.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\SVCHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\DVDUPGRD.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\PRINTUI.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\REGISTERIEPKEYS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\WIMSERV.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SYSWOW64\WSMANHTTPCONFIG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\DISKRAID.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\INSTALLSHIELD\SETUP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\NET.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPROTECTION.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEINSTAL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVA.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\TNAMESERV.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MULTIPLAYER\BACKGAMMON\BCKGZM.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MULTIPLAYER\SPADES\SHVLZM.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACROBROKER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KTAB.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\MSASCUI.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\PIPANEL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\MSOXMLED.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\EXCELCNV.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\KLIST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\UNPACK200.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DISABLEDGOOGLEUPDATE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS PHOTO VIEWER\IMAGINGDEVICES.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UPDATER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JCONSOLE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JSADEBUGD.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\RMIREGISTRY.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPENC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE AIR\VERSIONS\1.0\TEMPLATE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JSTAT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVA.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACRORD32INFO.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\OFFICE SETUP CONTROLLER\SETUP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\1033\ONELEV.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPDMC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPLAYER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\XJC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPRPH.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\CHROME_PWA_LAUNCHER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JSTACK.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWS JOURNAL\JOURNAL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\SHAPECOLLECTOR.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JP2LAUNCHER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\SMART TAG\SMARTTAGINSTALL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAFXPACKAGER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JP2LAUNCHER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\SERVERTOOL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MINESWEEPER\MINESWEEPER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WAB.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IELOWUTIL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\MSOICONS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\XLICONS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\IDLJ.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\A3DUTILITY.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\RESOURCE\ICONS\SC_READER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MISC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPSHARE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ADOBECOLLABSYNC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\SETLANG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNSCFG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\ACCICONS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSPUB.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\NOTIFICATION_HELPER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\APT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COMPACT_31BF3856AD364E35_6.1.7600.16385_NONE_55EA2C71CF438FFC\COMPACT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LEGACYHWUI_31BF3856AD364E35_6.1.7600.16385_NONE_3E69140A61F1EFF5\HDWWIZ.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MSPAINT_31BF3856AD364E35_6.1.7600.16385_NONE_EA12784C0842BFC1\MSPAINT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\MSIL_SERVICEMODELREG_B03F5F7F11D50A3A_6.1.7601.17514_NONE_1F2918ADB8A9C100\SERVICEMODELREG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\IEEXEC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..RESTARTUP-BAAUPDATE_31BF3856AD364E35_6.1.7600.16385_NONE_9243B833ECD918DF\BAAUPDATE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-VSSSERVICE_31BF3856AD364E35_6.1.7601.17514_NONE_B8F2D3E62E76FE08\VSSVC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMPNSS-SERVICE_31BF3856AD364E35_6.1.7601.17514_NONE_61ACD141E5332BAF\WMPNETWK.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SHAREDACCESS_31BF3856AD364E35_6.1.7600.16385_NONE_6B16FA9F975E1109\ICSUNATTEND.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\WFSERVICESREG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DEVICEPAIRINGAPP_31BF3856AD364E35_6.1.7600.16385_NONE_CB9353551BBD8ED8\DEVICEPAIRINGWIZARD.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EXTRAC32_31BF3856AD364E35_6.1.7600.16385_NONE_371E8C461D966A55\EXTRAC32.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..EOPTIONALCOMPONENTS_31BF3856AD364E35_11.2.9600.16428_NONE_E410F56F6C4EE930\CONFIGUREIEOPTIONALCOMPONENTS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PACKAGEMANAGER_31BF3856AD364E35_6.1.7601.17514_NONE_4AFDC98B09E3CFE8\PKGMGR.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-STICKYNOTES-APP_31BF3856AD364E35_6.1.7600.16385_NONE_493BA8A4D2FC9697\STIKYNOT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_6.1.7601.17514_NONE_34CE5D95AD203BBE\ROUTE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\ADDINPROCESS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..VIRONMENT-OS-LOADER_31BF3856AD364E35_6.1.7601.17514_NONE_B94CBFA183466A89\WINRESUME.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..DEVICESCONTROLPANEL_31BF3856AD364E35_6.1.7600.16385_NONE_8094BD7B62D2B435\IMAGINGDEVICES.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-INTERNETEXPLORER_31BF3856AD364E35_11.2.9600.16428_NONE_11B913172F0CB26F\IEUNATT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..CSENGINE-NATIVEHOST_31BF3856AD364E35_6.1.7600.16385_NONE_761AD65676427BD9\SDIAGNHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..FOR-MANAGEMENT-CORE_31BF3856AD364E35_6.1.7601.17514_NONE_288B7ACEC3A75696\WSMPROVHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-GPOWERSHELL-EXE_31BF3856AD364E35_6.1.7600.16385_NONE_94861149BB66249C\POWERSHELL_ISE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..S-MDAC-ODBCCONF-EXE_31BF3856AD364E35_6.1.7600.16385_NONE_696BCC240BCE3CA9\ODBCCONF.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..OPERTIESPERFORMANCE_31BF3856AD364E35_6.1.7600.16385_NONE_B6CB9ED71C8B43D5\SYSTEMPROPERTIESPERFORMANCE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\QAPPSRV.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\INSTALLER\{90140000-0011-0000-0000-0000000FF1CE}\GRVICONS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CREDWIZ_31BF3856AD364E35_6.1.7600.16385_NONE_FBCFA2528586252F\CREDWIZ.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-GRPCONV_31BF3856AD364E35_6.1.7600.16385_NONE_FE7D1685575EDFA6\GRPCONV.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SERVICINGSTACK_31BF3856AD364E35_6.1.7601.17514_NONE_678566B7DDEA04A5\PKGMGR.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SYSINFO_31BF3856AD364E35_6.1.7600.16385_NONE_4B49A2C2123FD42C\SYSTEMINFO.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-T..CESFRAMEWORK-CTFMON_31BF3856AD364E35_6.1.7600.16385_NONE_9D06E2F6F1E51F98\CTFMON.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TABLETPC-JOURNAL_31BF3856AD364E35_6.1.7601.17514_NONE_75D78DC0BB37C026\JOURNAL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WCF-SMSVCHOST_B03F5F7F11D50A3A_6.1.7600.16385_NONE_C7F13AF70AC77B22\SMSVCHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMSVCHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..IME-UPGRADE-RESULTS_31BF3856AD364E35_6.1.7601.17514_NONE_21DE7E134213566A\WINDOWSANYTIMEUPGRADERESULTS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..ENVIRONMENT-WINDOWS_31BF3856AD364E35_6.1.7601.17514_NONE_C75E9C99A36A285A\WINLOAD.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..IONDATA-CMDLINETOOL_31BF3856AD364E35_6.1.7601.17514_NONE_E6510234BBCB2A8C\BCDEDIT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..-JAPANESE-UTILITIES_31BF3856AD364E35_6.1.7601.17514_NONE_4B57445488BA33FD\IMJPDADM.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TIMEOUT_31BF3856AD364E35_6.1.7600.16385_NONE_E8595E67DFF5B7F4\TIMEOUT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMI-TOOLS_31BF3856AD364E35_6.1.7600.16385_NONE_33F05B889D506D0A\WBEMTEST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-ISCSI_INITIATOR_UI_31BF3856AD364E35_6.1.7600.16385_NONE_D7C180D4BD657495\ISCSICPL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-P..NCETOOLSCOMMANDLINE_31BF3856AD364E35_6.1.7601.17514_NONE_632AE4BC5D173763\LOGMAN.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\DFSVC\9BC0D921859B039D6E9F642148333949\DFSVC.NI.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_STATE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_REGSQL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-AUTHENTICATION-LOGONUI_31BF3856AD364E35_6.1.7601.17514_NONE_C3B917FD89D834F3\LOGONUI.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RPC-LOCATOR_31BF3856AD364E35_6.1.7600.16385_NONE_2B2984D40648FBE7\LOCATOR.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SRDELAYED_31BF3856AD364E35_6.1.7600.16385_NONE_B252497A75D8A174\SRDELAYED.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-ADAPTERTROUBLESHOOTER_31BF3856AD364E35_6.1.7600.16385_NONE_D1D79DD7E49A786F\ADAPTERTROUBLESHOOTER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-NET-COMMAND-LINE-TOOL_31BF3856AD364E35_6.1.7600.16385_NONE_5208A7A3D3CAA54C\NET.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-SYSINFO_31BF3856AD364E35_6.1.7600.16385_NONE_EF2B073E59E262F6\SYSTEMINFO.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-WININIT_31BF3856AD364E35_6.1.7600.16385_NONE_30C90EF265A43C13\WININIT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCORSVW.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_EVENTVIEWERSETTINGS_31BF3856AD364E35_6.1.7600.16385_NONE_50ECC9AE1D642AA9\EVENTVWR.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-PERFORMANCETOOLSGUI_31BF3856AD364E35_6.1.7601.17514_NONE_04846DECEBF43C4C\PERFMON.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-HTMLAPPLICATION_31BF3856AD364E35_8.0.7600.16385_NONE_D009281F9A108E04\MSHTA.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-MEDIAFOUNDATION_31BF3856AD364E35_6.1.7601.17514_NONE_04D9DEFD57C1F6BF\RRINSTALLER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CASPOL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_REGIIS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IIS-MANAGEMENTCONSOLE_31BF3856AD364E35_6.1.7600.16385_NONE_E3C88F07D4C88269\INETMGR.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..MPROPERTIESADVANCED_31BF3856AD364E35_6.1.7600.16385_NONE_533D797EFDF7728B\SYSTEMPROPERTIESADVANCED.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IIS-LEGACYSNAPIN_31BF3856AD364E35_6.1.7601.17514_NONE_DF46D976C8A5880B\INETMGR6.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-COM-SURROGATE_31BF3856AD364E35_6.1.7600.16385_NONE_43FA44D954D596E7\DLLHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2484 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2484 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe 2484 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe"C:\Users\Admin\AppData\Local\Temp\782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2484
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1