Analysis
-
max time kernel
103s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-10-2024 04:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
120 seconds
General
-
Target
53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe
-
Size
242KB
-
MD5
248c05ffc5214d6d892a4eaf572ab520
-
SHA1
497bc85f1d9645af350e1418be7e2c46891c3710
-
SHA256
53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243df
-
SHA512
974643827dcbdd9da678ee9035c3d359e183c66f8355b14194deeb093a0e4cb1a15f6548065a1539fb728fda2e5484f235020a575ac209e9f6752993be46b4b1
-
SSDEEP
6144:u6FJph/ox1M7JtLLpSVurRuTb2syNcGJNG:uekqtLLpFRuH2syF
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\U: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\T: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\X: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\Y: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\I: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\N: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\Q: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\R: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\M: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\P: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\H: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\J: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\K: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\L: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\W: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\Z: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\E: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\G: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\O: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened (read-only) \??\V: 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\ICACLS.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\NDADMIN.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_SSP.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\SETTINGSYNCHOST.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\DIALER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\DISM.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\DPLAYSVR.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\FINGER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\KTMUTIL.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\SYNCHOST.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIADAP.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\WPDSHEXTAUTOPLAY.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\MSTSC.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\SETUP16.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\CREDWIZ.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\FLTMC.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPDCT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMCCPHR.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\DISKPART.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\EXPAND.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\SETX.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\TAR.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\XWIZARD.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\CERTENROLLCTRL.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNESVR.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\EDPNOTIFY.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\MAVINJECT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\REPLACE.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\TAKEOWN.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\WSMPROVHOST.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\CALC.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\CONTROL.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\CSCRIPT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\DCCW.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\ATTRIB.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\DTDUMP.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\FTP.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\TSTHEME.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\WEXTRACT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\WOWREG32.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\INFDEFAULTINSTALL.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\NET1.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\PERFHOST.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\RASDIAL.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\GPSCRIPT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\INPUTSWITCHTOASTHANDLER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\MFPMP.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\MSPAINT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\CLOUDNOTIFICATIONS.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\PRINT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\ROBOCOPY.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\RPCPING.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\POQEXEC.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\RDPSAUACHELPER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_ISV.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHINDEXER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\APPIDTEL.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\DRIVERQUERY.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPSET.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\MAGNIFY.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\VERCLSID.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL_ISE.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\SECEDIT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SysWOW64\TCMSETUP.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\BHO\IE_TO_EDGE_STUB.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JJS.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\INTEGRATION\INTEGRATOR.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\EXCELCNV.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX86\MICROSOFT SHARED\EQUATION\EQNEDT32.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXSPEECHTOTEXTOVERLAY_1.17.29001.0_X64__8WEKYB3D8BBWE\SPEECHTOTEXTOVERLAY64-RETAIL.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\EULA.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.DESKTOPAPPINSTALLER_1.0.30251.0_X64__8WEKYB3D8BBWE\APPINSTALLER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.DESKTOPAPPINSTALLER_1.0.30251.0_X64__8WEKYB3D8BBWE\APPINSTALLERELEVATEDAPPSERVICECLIENT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVCLEANER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTACK.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVA-RMI.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\TNAMESERV.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SETLANG.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\APPSHARINGHOOKCONTROLLER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.GETHELP_10.1706.13331.0_X64__8WEKYB3D8BBWE\GETHELP.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\COOKIE_EXPORTER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\COMMON.DBCONNECTION.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-0409-1000-0000000FF1CE}\MISC.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SSVAGENT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVA.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVACPL.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ORGCHART.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\PUBS.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\READER_SL.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.371\GOOGLEUPDATECOMREGISTERSHELL64.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\EXTCHECK.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAH.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVACPL.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPRPH.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\WINDOWS PHOTO VIEWER\IMAGINGDEVICES.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\PACK200.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSQRY32.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IELOWUTIL.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\IDLJ.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KLIST.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\XJC.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVAWS.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSSOUNDRECORDER_10.1906.1972.0_X64__8WEKYB3D8BBWE\SOUNDREC.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROCEF\RDRSERVICESUPDATER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OSMCLIENTICON.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\123.0.6312.123\ELEVATION_SERVICE.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KLIST.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DOWNLOAD\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\CHROME_INSTALLER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MAVINJECT32.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSADEBUGD.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\VPREVIEW.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.BINGWEATHER_4.25.20211.0_X64__8WEKYB3D8BBWE\MICROSOFT.MSN.WEATHER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\WSIMPORT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.NETFX45.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\OLICENSEHEARTBEAT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16005.11629.20316.0_X64__8WEKYB3D8BBWE\HXTSR.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH\JAVAW.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\IDENTITY_HELPER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JP2LAUNCHER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\ORBD.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGIN-CONTAINER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXGAMINGOVERLAY_2.34.28001.0_X64__8WEKYB3D8BBWE\GAMEBAR.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..NAGEMENT-APPVCLIENT_31BF3856AD364E35_10.0.19041.1202_NONE_4132A4047D5D53B2\F\SYNCAPPVPUBLISHINGSERVER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMI-CORE_31BF3856AD364E35_10.0.19041.1081_NONE_2E31E8EED4B770C3\UNSECAPP.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-MSINFO32-EXE_31BF3856AD364E35_10.0.19041.1_NONE_6C221EACCD6C91AE\MSINFO32.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ERRORREPORTINGFAULTS_31BF3856AD364E35_10.0.19041.264_NONE_4DE8BD849BAAA96F\R\WERFAULT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ICM-DCCW_31BF3856AD364E35_10.0.19041.1_NONE_D0DFB9642DE0D432\DCCW.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RECOVERYDRIVE_31BF3856AD364E35_10.0.19041.1237_NONE_9D556CF140E198B4\F\RECOVERYDRIVE.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BTH-USER_31BF3856AD364E35_10.0.19041.1_NONE_1B0A4D6F748B99F5\BTHUDTASK.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..ARTCARD-TPM-MANAGER_31BF3856AD364E35_10.0.19041.746_NONE_790F12933FBF7E0D\R\TPMVSCMGRSVR.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-STARTTILEDATA_31BF3856AD364E35_10.0.19041.1202_NONE_05856BBD8F935E6B\F\DATASTORECACHEDUMPTOOL.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\X86_NETFX-DW_B03F5F7F11D50A3A_10.0.19041.1_NONE_8E850C52AC392AE6\DW20.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADDINPROCESS32_B77A5C561934E089_10.0.19041.1_NONE_3700BDC08C446A5C\ADDINPROCESS32.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ESSLOCKAPP.APPXMAIN_31BF3856AD364E35_10.0.19041.844_NONE_15E5BFCD83A1911A\F\ASSIGNEDACCESSLOCKAPP.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..DIALOGHOST.APPXMAIN_31BF3856AD364E35_10.0.19041.423_NONE_EDAB5DD3A4C202D9\CREDDIALOGHOST.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CONTAINERS-CCG_31BF3856AD364E35_10.0.19041.844_NONE_3A7392AF5414371E\F\CCG.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NETBT_31BF3856AD364E35_10.0.19041.572_NONE_3E399E76562F6053\NETBTUGC.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WCF-SMSVCHOST_B03F5F7F11D50A3A_10.0.19041.1_NONE_B4528A0BDF7B6CEE\SMSVCHOST.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-ADVANCEDTASKMANAGER_31BF3856AD364E35_10.0.19041.1_NONE_6F2C92B5BF3D99BC\LAUNCHTM.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_32\MSBUILD\V4.0_4.0.0.0__B03F5F7F11D50A3A\MSBUILD.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.OOBENETWORKCONNECTIONFLOW_CW5N1H2TXYEWY\OOBENETWORKCONNECTIONFLOW.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPMANAGEMENT-UEVAGENT_31BF3856AD364E35_10.0.19041.1288_NONE_71734BF99A2A6955\UEVAGENTPOLICYGENERATOR.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..VIRONMENT-OS-LOADER_31BF3856AD364E35_10.0.19041.1266_NONE_CFEC8DB821D83671\R\WINRESUME.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..FOR-MANAGEMENT-CORE_31BF3856AD364E35_10.0.19041.1288_NONE_3F2D1BE96237886E\WSMANHTTPCONFIG.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EXPLORER_31BF3856AD364E35_10.0.19041.1266_NONE_C67A7A982EEDC4E8\F\EXPLORER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DEFRAG-ADMINUI_31BF3856AD364E35_10.0.19041.746_NONE_770F598AEF14382E\F\DFRGUI.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..OMMANDLINEUTILITIES_31BF3856AD364E35_10.0.19041.1_NONE_330DFB2B06B21AF6\REPLACE.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-REGSVR32_31BF3856AD364E35_10.0.19041.1_NONE_2E482AD4CEE11EAD\REGSVR32.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SCRIPTING_31BF3856AD364E35_10.0.19041.1237_NONE_BD2B0EF5B58E1540\CSCRIPT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-WOW64-LEGACY_31BF3856AD364E35_10.0.19041.1023_NONE_6AEAB5D4BD0371A8\INSTNM.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CONTAINER-MANAGER_31BF3856AD364E35_10.0.19041.1266_NONE_07A5D18B92D8B668\R\CMIMAGEWORKER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..ING-MANAGEMENT-CORE_31BF3856AD364E35_10.0.19041.746_NONE_092D70D1898E5FF9\DISMHOST.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX4-ASPNET_WP_EXE_B03F5F7F11D50A3A_4.0.15805.0_NONE_0E9691AC6FEEDC0D\ASPNET_WP.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..WSUPDATECLIENT-CORE_31BF3856AD364E35_10.0.19041.207_NONE_8D07DE31084775C6\R\WUAUCLT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-EVENTLOG-COMMANDLINE_31BF3856AD364E35_10.0.19041.1202_NONE_3FE90CDB6667211E\R\WEVTUTIL.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-ICM-UI_31BF3856AD364E35_10.0.19041.746_NONE_22A6AC8933FF6D5E\COLORCPL.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..NAGEMENT-APPVCLIENT_31BF3856AD364E35_10.0.19041.264_NONE_AA5417FD2708544D\F\SYNCAPPVPUBLISHINGSERVER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..ALENROLLMENTMANAGER_31BF3856AD364E35_10.0.19041.1202_NONE_1A780FF3456B7BCD\CREDENTIALENROLLMENTMANAGER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-QUICKASSIST_31BF3856AD364E35_10.0.19041.1266_NONE_72C6A00123F43C47\QUICKASSIST.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-SPP-UX-DLG_31BF3856AD364E35_10.0.19041.746_NONE_7C508E4438CEC899\PHONEACTIVATE.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..OMMAND-LINE-UTILITY_31BF3856AD364E35_10.0.19041.1_NONE_579AE2E26C347896\WMIC.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..NAGEMENT-APPVCLIENT_31BF3856AD364E35_10.0.19041.1202_NONE_4132A4047D5D53B2\F\APPVNICE.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-G..POLICY-CMDLINETOOLS_31BF3856AD364E35_10.0.19041.1_NONE_F15A0C837B51C5FC\GPRESULT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAFOUNDATION_31BF3856AD364E35_10.0.19041.1288_NONE_1126D5C5C1F1669C\MFPMP.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SYSTEMRESTORE-MAIN_31BF3856AD364E35_10.0.19041.746_NONE_24D91AB4120E42EE\F\RSTRUI.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..WSUPDATECLIENT-CORE_31BF3856AD364E35_10.0.19041.1288_NONE_23AA03725EC9354A\WUAUCLT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-P..NCETOOLSCOMMANDLINE_31BF3856AD364E35_10.0.19041.546_NONE_49716C2392052ACA\TRACERPT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-U..ETRY-CLIENT-WOWONLY_31BF3856AD364E35_10.0.19041.662_NONE_746C3BFAA509091F\DTDUMP.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ACROBROKER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\VBC.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\WINDOWS.CBSPREVIEW_CW5N1H2TXYEWY\CAMERABARCODESCANNERPREVIEW.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-BTH-USER_31BF3856AD364E35_10.0.19041.746_NONE_4D67350A685E1A3A\FSQUIRT.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-DISKPART_31BF3856AD364E35_10.0.19041.964_NONE_510EBDD9292EED06\DISKPART.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ROBLEMSTEPSRECORDER_31BF3856AD364E35_10.0.19041.746_NONE_B8EADBF8A9C907B3\PSR.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-SPP-EXTCOM_31BF3856AD364E35_10.0.19041.1202_NONE_7F995FDDF54C000C\R\SPPEXTCOMOBJ.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SERVICES-SVCHOST_31BF3856AD364E35_10.0.19041.546_NONE_9E094AF3987DCA57\SVCHOST.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\X86_NETFX-ASPNET_WP_EXE_B03F5F7F11D50A3A_10.0.19041.1_NONE_85D1745A1D49397F\ASPNET_WP.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-IECHOOSER_31BF3856AD364E35_11.0.19041.746_NONE_122A74C9827FE81A\R\IECHOOSER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_STATE.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-MOBSYNCEXE_31BF3856AD364E35_10.0.19041.1_NONE_AF96916428136673\MOBSYNC.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPID_31BF3856AD364E35_10.0.19041.1_NONE_0D3D1DCF5184D281\APPIDCERTSTORECHECK.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPMANAGEMENT-UEVAGENT_31BF3856AD364E35_10.0.19041.1288_NONE_71734BF99A2A6955\MICROSOFT.UEV.SYNCCONTROLLER.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LOCKAPPHOST_31BF3856AD364E35_10.0.19041.746_NONE_D99FD60BC1FDE773\F\LOCKAPPHOST.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SMSS-MINWIN_31BF3856AD364E35_10.0.19041.964_NONE_5C42846F47ACB1A6\R\SMSS.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-ROBOCOPY_31BF3856AD364E35_10.0.19041.1_NONE_874CE756C022852F\ROBOCOPY.EXE 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe"C:\Users\Admin\AppData\Local\Temp\53ce52ffa0c37fe6f090366783eab6163ac039d1c1b13730fb1640031c8243dfN.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3604
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1