Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
115s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 02:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
120 seconds
General
-
Target
782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe
-
Size
52KB
-
MD5
68fd9d42e61c9c7c4e9ccb557068b4f0
-
SHA1
2adf9f47d9a5128d2c3b1a43146d42c3c66fc0d8
-
SHA256
782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8c
-
SHA512
c4e05df4a4cfbadafb038f211df316a1cf586de9db0755ab0b7c1490fe66513bb783eb18f9e353dd65949ee51c1abcd9622f2ca696740a1c0bc967dad435ab60
-
SSDEEP
768:FlQ4hrvaEGU4aikqykezg2XpfY9jYioRoNFYl5:fLhE1Dezg2ZfYUoPO5
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\T: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\V: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\W: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\O: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\Q: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\S: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\E: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\H: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\J: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\K: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\L: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\X: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\Y: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\I: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\M: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\U: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\Z: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\G: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\P: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened (read-only) \??\R: 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\SFC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\CMSTP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPUEXC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\MSIEXEC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\PICKERHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\POWERCFG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERPT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\UPNPCONT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\USERACCOUNTBROKER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\BOOTCFG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\LAUNCHWINAPP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_ISV.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTRAY.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\USERINIT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\DPNSVR.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\GPRESULT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\HELP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\NET.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\AUTOFMT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\DRIVERQUERY.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\FSQUIRT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\LOGAGENT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\MSFEEDSSYNC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\MUIUNATTEND.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\TTDINJECT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\HOSTNAME.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\MMC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\PROVLAUNCH.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\QUICKASSIST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\REKEYWIZ.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\REGEDIT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\AUDITPOL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\DLLHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\MTSTOCOM.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\PERFHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\REGISTER-CIMPROVIDER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\SHRPUBW.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\TAR.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\TYPEPERF.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\MAVINJECT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\NDADMIN.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\PING.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\RUNDLL32.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\SDCHANGE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\SDIAGNHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\TIMEOUT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\XCOPY.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\BACKGROUNDTASKHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\CHARMAP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\PREVHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\WINRS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\WPDSHEXTAUTOPLAY.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\ARP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\CMD.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\DDODIAG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\MSRA.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPSET.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC\IMTCPROP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\INSTALLSHIELD\_ISDEL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\SUBST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\SYNCHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\TAKEOWN.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\SysWOW64\FLTMC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\FULLTRUSTNOTIFIER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\DOTNET\DOTNET.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.NETFX40.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MIXEDREALITY.PORTAL_2000.19081.1301.0_X64__8WEKYB3D8BBWE\MIXEDREALITYPORTAL.BROKERED.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ADELRCP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\FLTLDR.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\DBCICONS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.DESKTOPAPPINSTALLER_1.0.30251.0_X64__8WEKYB3D8BBWE\APPINSTALLERELEVATEDAPPSERVICECLIENT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WEBPIMAGEEXTENSION_1.0.22753.0_X64__8WEKYB3D8BBWE\CODECPACKS.WEBP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\APPLETVIEWER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KINIT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\SERVERTOOL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\SSCICONS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVA-RMI.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JABSWITCH.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOHTMED.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PPTICO.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\XJC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION_4.4.8204.0_X64__8WEKYB3D8BBWE\SOLITAIRE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SKYPEAPP_14.53.77.0_X64__KZF8QXF38ZG5C\SKYPEBACKGROUNDHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\127.0.2651.86\IDENTITY_HELPER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JJS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOSYNC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\SMART TAG\SMARTTAGINSTALL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KTAB.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\RMIC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\TNAMESERV.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\PACK200.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.371\GOOGLEUPDATECOMREGISTERSHELL64.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\MOZILLA MAINTENANCE SERVICE\MAINTENANCESERVICE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPLAYER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWS NT\ACCESSORIES\WORDPAD.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFT3DVIEWER_6.1908.2042.0_X64__8WEKYB3D8BBWE\VIEW3D.RESOURCERESOLVER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSSTORE_11910.1002.5.0_X64__8WEKYB3D8BBWE\WINSTORE.APP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\127.0.2651.86\BHO\IE_TO_EDGE_STUB.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\PWAHELPER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\123.0.6312.123\CHROME_PWA_LAUNCHER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\RMIREGISTRY.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT ANALYSIS SERVICES\AS OLEDB\140\SQLDUMPER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.GETSTARTED_8.2.22942.0_X64__8WEKYB3D8BBWE\WHATSNEW.STORE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SKYPESRV\SKYPESERVER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OUTICON.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION_4.4.8204.0_X64__8WEKYB3D8BBWE\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSSOUNDRECORDER_10.1906.1972.0_X64__8WEKYB3D8BBWE\SOUNDREC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\EXTCHECK.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JJS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVAW.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\INTEGRATION\ADDONS\ONEDRIVESETUP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\LOGTRANSPORT2.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVCLEANER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\INTEGRATEDOFFICE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\WSIMPORT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE 15\CLIENTX64\OFFICECLICKTORUN.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\RMID.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\EXCEL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\GRV_ICONS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.GETSTARTED_8.2.22942.0_X64__8WEKYB3D8BBWE\FMUI\FMUI.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAPACKAGER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JINFO.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTAT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-G..POLICY-CMDLINETOOLS_31BF3856AD364E35_10.0.19041.1_NONE_FBAEB6D5AFB287F7\GPRESULT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SECURITYCENTER-CORE_31BF3856AD364E35_10.0.19041.1081_NONE_9972EDDE9B98690C\F\WSCADMINUI.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..NTSCONTROL.APPXMAIN_31BF3856AD364E35_10.0.19041.423_NONE_6C3451A09CBA3850\F\ACCOUNTSCONTROLHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-AUTHENTICATION-LOGONUI_31BF3856AD364E35_10.0.19041.1_NONE_1B8420121296312D\LOGONUI.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..VIRONMENT-OS-LOADER_31BF3856AD364E35_10.0.19041.1266_NONE_CFEC8DB821D83671\WINLOAD.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-R..VERYCENTER-PLATFORM_31BF3856AD364E35_10.0.19041.964_NONE_21209B01F08AFD33\SYSTEMRESETPLATFORM.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WORDPAD_31BF3856AD364E35_10.0.19041.1202_NONE_A27AA61D221BDC5C\F\WORDPAD.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\TEMP\PENDINGDELETES\9714214736E5D7015BA100001815341F.ADAMSYNC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-DRIVERVERIFIER-TOOLS_31BF3856AD364E35_10.0.19041.1_NONE_76EDADEC5BA257B3\VERIFIER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX4-APPLAUNCH_EXE_B03F5F7F11D50A3A_4.0.15805.0_NONE_A89F46F8BFAC0A1E\APPLAUNCH.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..NAGEMENT-APPVCLIENT_31BF3856AD364E35_10.0.19041.1202_NONE_4132A4047D5D53B2\F\APPVNICE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-AUTOPLAY_31BF3856AD364E35_10.0.19041.1266_NONE_8FC08423F52C1606\WMLAUNCH.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-XBOX-GAMEOVERLAY_31BF3856AD364E35_10.0.19041.746_NONE_2703BED0BA809808\F\GAMEPANEL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-IEINSTAL_31BF3856AD364E35_11.0.19041.1_NONE_765FC5F6E37C509D\IEINSTAL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ENCE-INFRASTRUCTURE_31BF3856AD364E35_10.0.19041.928_NONE_B321F2C2AB7710A2\SDBINST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..ICE-DAF-POSPAYMENTS_31BF3856AD364E35_10.0.19041.1_NONE_0B83240C6BC26A13\POSPAYMENTSWORKER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..NAGEMENT-APPVCLIENT_31BF3856AD364E35_10.0.19041.264_NONE_AA5417FD2708544D\R\APPVSTREAMINGUX.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-E..RISECLIENTSYNC-HOST_31BF3856AD364E35_10.0.19041.1202_NONE_42D3A7D52BCB0F8D\R\WORKFOLDERS.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMI-CORE_31BF3856AD364E35_10.0.19041.1081_NONE_2E31E8EED4B770C3\R\WMIADAP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\MSIL_MULTIPOINT-WMSDASHBOARD_31BF3856AD364E35_10.0.19041.1_NONE_061D84508B376F80\WMSDASHBOARD.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-THUMBEXTHOST_31BF3856AD364E35_10.0.19041.746_NONE_D8BAEDF8D09ABA05\F\THUMBNAILEXTRACTIONHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\COMSVCCONFIG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..MENT-WINDOWS-MINWIN_31BF3856AD364E35_10.0.19041.173_NONE_2DC175215AE8EC39\WINLOAD.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-PICKERHOST_31BF3856AD364E35_10.0.19041.1023_NONE_2CD9CC4237E09B91\F\PICKERHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\ADDINPROCESS32.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LPKINSTALL_31BF3856AD364E35_10.0.19041.1_NONE_BF2412B3EA69B4CB\LPKINSTALL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-TOOLS-KLIST_31BF3856AD364E35_10.0.19041.1266_NONE_B5FA73367BBD2F91\R\KLIST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SYSTEMRESET_31BF3856AD364E35_10.0.19041.1266_NONE_5FD6523A3130632D\RESETENGINE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURESTARTUP-UNLOCK_31BF3856AD364E35_10.0.19041.746_NONE_428EFBD28B482D1C\F\BDEUNLOCK.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..COMMANDLINETOOLSMQQ_31BF3856AD364E35_10.0.19041.1_NONE_DF1A7EE54B62A4FD\MSG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-EVENTLOG-COMMANDLINE_31BF3856AD364E35_10.0.19041.1202_NONE_3FE90CDB6667211E\R\WEVTUTIL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SHAREDFOLDERSUI_31BF3856AD364E35_10.0.19041.746_NONE_A06B29F6C4BAB99E\SHRPUBW.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPMANAGEMENT-UEVAGENT_31BF3856AD364E35_10.0.19041.1_NONE_B29CB2F3845833B7\APPLYSETTINGSTEMPLATECATALOG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..AL-CHINESE-MOIMEEXE_31BF3856AD364E35_10.0.19041.746_NONE_0F44A2D7A5E3A37A\F\CHTIME.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FILTERMANAGER-UTILS_31BF3856AD364E35_10.0.19041.546_NONE_F786FA028426F858\R\FLTMC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-SPP-EXTCOM_31BF3856AD364E35_10.0.19041.84_NONE_027C502C6E331223\F\SPPEXTCOMOBJ.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-WORKSPACERUNTIME_31BF3856AD364E35_10.0.19041.746_NONE_045E85893C117E35\F\WKSPRT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMPNSS-SERVICE_31BF3856AD364E35_10.0.19041.746_NONE_E180169F2D62E633\F\WMPNETWK.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-DISKPART_31BF3856AD364E35_10.0.19041.1_NONE_291E1D3069AB2F3A\DISKPART.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DNS-CLIENT_31BF3856AD364E35_10.0.19041.572_NONE_BFB752F1E1449C59\F\DNSCACHEUGC.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IEINSTAL_31BF3856AD364E35_11.0.19041.1_NONE_D27E617A9BD9C1D3\IEINSTAL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MDMAPPINSTALLER_31BF3856AD364E35_10.0.19041.844_NONE_77A5D9AAFAE08E77\F\MDMAPPINSTALLER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-NGC-TRUSTLET_31BF3856AD364E35_10.0.19041.423_NONE_C3EAC275ECDF7E0A\F\NGCISO.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SERVICINGSTACK_31BF3856AD364E35_10.0.19041.1_NONE_BF506ECC66A800DF\TIWORKER.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-COMPACT_31BF3856AD364E35_10.0.19041.1_NONE_BA3AF2A08950D1CB\COMPACT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\DATASVCUTIL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_EVENTVIEWERSETTINGS_31BF3856AD364E35_10.0.19041.1_NONE_B53D8FDCD7716C78\EVENTVWR.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..DIALOGHOST.APPXMAIN_31BF3856AD364E35_10.0.19041.423_NONE_EDAB5DD3A4C202D9\R\CREDDIALOGHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LUA_31BF3856AD364E35_10.0.19041.746_NONE_8443A7FEBB9AB03D\R\CONSENT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETWORKING-MPSSVC-NETSH_31BF3856AD364E35_10.0.19041.1151_NONE_23C0AA3B7BD960CD\CHECKNETISOLATION.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..RANDPRINTUI-NTPRINT_31BF3856AD364E35_10.0.19041.1288_NONE_64CB20C6329BF2BD\F\NTPRINT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SHELLHOST_31BF3856AD364E35_10.0.19041.746_NONE_F47187F881CBAF7D\R\SIHOST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TIERINGENGINE_31BF3856AD364E35_10.0.19041.746_NONE_8D7110D8C33B651F\R\TIERINGENGINESERVICE.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..OMMANDLINEUTILITIES_31BF3856AD364E35_10.0.19041.1_NONE_330DFB2B06B21AF6\SUBST.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURESTARTUP-CPL_31BF3856AD364E35_10.0.19041.1202_NONE_CC46843E404EB749\F\BITLOCKERWIZARDELEV.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-NEWDEV_31BF3856AD364E35_10.0.19041.1_NONE_D1BC032A24676029\NEWDEV.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..RARYDIALOG.APPXMAIN_31BF3856AD364E35_10.0.19041.1_NONE_83B794E5516730A0\ADDSUGGESTEDFOLDERSTOLIBRARYDIALOG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LUA_31BF3856AD364E35_10.0.19041.1_NONE_5C3B6AB5FC28F1F3\CONSENT.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-O..TIVEPORTAL.APPXMAIN_31BF3856AD364E35_10.0.19041.423_NONE_204AF7FF19532470\R\OOBENETWORKCAPTIVEPORTAL.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINHLP32.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..OMMANDLINE-REPADMIN_31BF3856AD364E35_10.0.19041.1_NONE_B6B53473F278F7CC\REPADMIN.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..AC-SQL-CLICONFG-EXE_31BF3856AD364E35_10.0.19041.1_NONE_260E545BF60F6B0F\CLICONFG.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-OPENWITH_31BF3856AD364E35_10.0.19041.1_NONE_2311DC3012116C15\OPENWITH.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMI-CORE_31BF3856AD364E35_10.0.19041.1081_NONE_2E31E8EED4B770C3\F\MOFCOMP.EXE 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1844 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe 1844 782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe"C:\Users\Admin\AppData\Local\Temp\782217990f16373c63bb2ca2919bb7171f7357b84ff1abf48d00c9e369da2b8cN.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1844
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4156,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:81⤵PID:2672
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1