Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 04:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
General
-
Target
f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe
-
Size
92KB
-
MD5
9367db1f6609f05516be7f469715f8c0
-
SHA1
c0adddf0353fc5ab2f0cc3b4b06fb9a056ae4556
-
SHA256
f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880
-
SHA512
a44c2d24792554ed0794ca53f080d36a289c15e196ca9f76af5d19db600140acd30435fd8b06608f9a0b6b4fb831ed625c0f66598fa509d65f72e4c471f25587
-
SSDEEP
1536:DHB0UxMkzOt7HcvJGt5AdHIOWnToIf12ZqTUga8on5o:DhAWJGSCTBf12Z1g1on5
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SYSWOW64\PSR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\LABEL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\LOGAGENT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\DVDPLAY.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\GETMAC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\REKEYWIZ.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\UTILMAN.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\COMPUTERDEFAULTS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\REGINI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\TASKKILL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\TCMSETUP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\MSTSC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\UNLODCTR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\WERMGR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\ISCSICLI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\DIVACX64.INF_AMD64_NEUTRAL_FA0F82F024789743\DITRACE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\WVMIC.INF_AMD64_NEUTRAL_B94EB92E8150FA35\VMICSVC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIADAP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESREMOTE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\XWIZARD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\EVENTCREATE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\EVENTVWR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\NET1.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\EXPLORER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\NSLOOKUP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\SETUP16.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\CMMON32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\NETPLWIZ.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\RUNDLL32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\TASKKILL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\NTKRNLPA.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESDATAEXECUTIONPREVENTION.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\SXSTRACE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\TCMSETUP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\CERTUTIL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\PROQUOTA.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\RASERVER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\XCOPY.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\DISKPERF.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\REGEDIT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\DPISCALING.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\PERFMON.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\MAKECAB.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\PKGMGR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\DDODIAG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\WECUTIL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\BTHUDTASK.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\ATBROKER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\AUDITPOL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\MIGWIZ\POSTMIG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\WINRS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\DOSKEY.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\IPCONFIG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\MIGWIZ\MIGHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\PRINTUI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\SFC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESCOMPUTERNAME.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\WIMSERV.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\RUNAS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\SDIAGNHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SYSWOW64\XPSRCHVW.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\PING.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMINFO.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\WORDCONV.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\INKWATSON.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACRORD32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\IECONTENTSERVICE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSOHTMED.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MULTIPLAYER\SPADES\SHVLZM.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACROTEXTEXTRACTOR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JARSIGNER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATECORE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPRPH.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\ONENOTEM.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WABMIG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\FLTLDR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATECOMREGISTERSHELL64.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\SHAPECOLLECTOR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KINIT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNETWK.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MISC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\KEYTOOL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KEYTOOL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\ORBD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\MOZILLA MAINTENANCE SERVICE\MAINTENANCESERVICE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\RMID.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\INSTALLER\SETUP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\MIP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WAB.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\IDLJ.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVA-RMI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVAWS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS SIDEBAR\SIDEBAR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PINGSENDER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATESETUP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEINSTAL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\WINWORD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\OARPMANY.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WINMAIL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE AIR\VERSIONS\1.0\ADOBE AIR APPLICATION INSTALLER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\GRAPH.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPLAYER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\ELEVATION_SERVICE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAWS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JDB.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\SSVAGENT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSOUC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPENC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\TABTIP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAW.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\WSIMPORT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\POLICYTOOL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\PACK200.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\TNAMESERV.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\CHESS\CHESS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WAB.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\SETUP FILES\{AC76BA86-7AD7-1033-7B44-A90000000001}\SETUP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSQRY32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\SPIDERSOLITAIRE\SPIDERSOLITAIRE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\DEFAULT-BROWSER-AGENT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JCMD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSBUILD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MAGNIFY_31BF3856AD364E35_6.1.7600.16385_NONE_CA22C913B260E66A\MAGNIFY.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\EHOME\MCX2PROV.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..TING-TOOLS-PRINTBRM_31BF3856AD364E35_6.1.7601.17514_NONE_DFE02DE35BF41E0B\PRINTBRM.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PNPUTIL_31BF3856AD364E35_6.1.7600.16385_NONE_5958B438D6388D15\PNPUTIL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\INSTALLER\{90140000-0011-0000-0000-0000000FF1CE}\MSOUC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\EHOME\WOW\EHEXTHOST32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_INFOCARD_B77A5C561934E089_6.1.7601.17514_NONE_583A8C60C0B305A1\INFOCARD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..OSTIC-USER-RESOLVER_31BF3856AD364E35_6.1.7600.16385_NONE_2129F6BD1F6002AE\DFDWIZ.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NETWORKBRIDGE_31BF3856AD364E35_6.1.7600.16385_NONE_63DEE2821FC69FCE\BRIDGEUNATTEND.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NEWDEV_31BF3856AD364E35_6.1.7600.16385_NONE_6D6B3CFB6A5A1E5A\NEWDEV.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SPEECHCOMMONNOIA64_31BF3856AD364E35_6.1.7600.16385_NONE_5E9E78A6DD413413\SAPISVR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSBUILD\F4A88265AC4AD47978DAEF8C5482FD30\MSBUILD.NI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURESTARTUP-CPL_31BF3856AD364E35_6.1.7601.17514_NONE_B5AC5CC3A1B7E9EF\BITLOCKERWIZARDELEV.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TABLETPC-CONTROLPANEL_31BF3856AD364E35_6.1.7601.17514_NONE_3D9977977190CDC4\TABCAL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-LDR64_EXE_31BF3856AD364E35_6.1.7600.16385_NONE_F98E4869675AB367\LDR64.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RASCONNECTIONMANAGER_31BF3856AD364E35_6.1.7601.17514_NONE_BD4644E077251730\CMMON32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..NCETOOLSCOMMANDLINE_31BF3856AD364E35_6.1.7601.17514_NONE_BF4980401574A899\LOGMAN.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\NGEN.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DISKRAID_31BF3856AD364E35_6.1.7601.17514_NONE_C3AFA97FAE99BBE4\DISKRAID.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\TSCON.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_WP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\EDMGEN.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\SERVICING\TRUSTEDINSTALLER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LEGACYHWUI_31BF3856AD364E35_6.1.7600.16385_NONE_3E69140A61F1EFF5\HDWWIZ.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NETBT_31BF3856AD364E35_6.1.7601.17514_NONE_BE8ACDD10DE3B1A6\NETBTUGC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\LOGOFF.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\MICROSOFT.WORKFLOW.COMPILER\V4.0_4.0.0.0__31BF3856AD364E35\MICROSOFT.WORKFLOW.COMPILER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..FLICKLEARNINGWIZARD_31BF3856AD364E35_6.1.7600.16385_NONE_69769FD78B751AD3\FLICKLEARNINGWIZARD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..LOCALSESSIONMANAGER_31BF3856AD364E35_6.1.7601.17514_NONE_036AD230212A39CE\LSM.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\EHEXTHOST\6.1.0.0__31BF3856AD364E35\EHEXTHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\DFSVC\BB4A1994DB088E84B9D383271B082250\DFSVC.NI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IIS-MANAGEMENTCONSOLE_31BF3856AD364E35_6.1.7600.16385_NONE_E3C88F07D4C88269\INETMGR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IPCONFIG_31BF3856AD364E35_6.1.7600.16385_NONE_A82EE2A7319FA8F8\IPCONFIG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..RESENTATIONSETTINGS_31BF3856AD364E35_6.1.7601.17514_NONE_CB4D60191A09A7B0\PRESENTATIONSETTINGS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-SETUP_31BF3856AD364E35_6.1.7601.17514_NONE_0C19CEF0ED2A642E\SETUP_WM.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SERVICES-SVCHOST_31BF3856AD364E35_6.1.7600.16385_NONE_11B04B481EFEC48C\SVCHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\COMSVCCONFIG\9A69A26417A09C2D9D7F67BF7592BD74\COMSVCCONFIG.NI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\SMSVCHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-OSK_31BF3856AD364E35_6.1.7600.16385_NONE_06B1C513739FB828\OSK.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-TOOLS-KLIST_31BF3856AD364E35_6.1.7600.16385_NONE_9D299157E03CE00F\KLIST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\INSTALLUTIL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SYSTRAY_31BF3856AD364E35_6.1.7600.16385_NONE_4F466E7A0FBB1A04\SYSTRAY.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CASPOL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DRIVERVERIFIER_31BF3856AD364E35_6.1.7600.16385_NONE_1660CCBEB66C6CF1\VERIFIER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BLB-ENGINE-MAIN_31BF3856AD364E35_6.1.7601.17514_NONE_4207FB67165F731A\WBENGINE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TPM-ADMINSNAPIN_31BF3856AD364E35_6.1.7600.16385_NONE_D3720895F8F22ACD\TPMINIT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\REGSVCS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..MPLUS-ADMIN-COMREPL_31BF3856AD364E35_6.1.7600.16385_NONE_45FE6FE8A9201E55\COMREPL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COMMANDLINEHELP_31BF3856AD364E35_6.1.7600.16385_NONE_3020274B22E8A90F\HELP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..INBOXGAMES-SHANGHAI_31BF3856AD364E35_6.1.7600.16385_NONE_1C98ED5D08DB04CE\MAHJONG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SMSS_31BF3856AD364E35_6.1.7600.16385_NONE_082F99A432E2A661\SMSS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSBUILD\B93C627EC2E15C2675BCC81EDAFB10BE\MSBUILD.NI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\CHGUSR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TABLETPC-JOURNAL_31BF3856AD364E35_6.1.7601.17514_NONE_75D78DC0BB37C026\JOURNAL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-DFSVC_B03F5F7F11D50A3A_6.1.7600.16385_NONE_96DBB959BA7C7A79\DFSVC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\MSBUILD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\CSC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\MSBUILD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\QPROCESS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DPAPI-KEYS_31BF3856AD364E35_6.1.7600.16385_NONE_D9C7C4A2E721DA7E\DPAPIMIG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SERVICEMODELREG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CASPOL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMCONFIGINSTALLER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe"C:\Users\Admin\AppData\Local\Temp\f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2416