Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/10/2024, 20:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
General
-
Target
128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe
-
Size
92KB
-
MD5
51cf90b7107fceb491274602ffb70bd0
-
SHA1
368e470c101d20ecbf9f1fa091eb30ca61ab2d95
-
SHA256
128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1
-
SHA512
40819892b33960d2486a4fc50701078afb557dfe39dc9c54d0e5f0094c0ba6f44639185ddd05a3b20ec8fc9f9882a006f57ad7f21fb1845f3fab08570281094a
-
SSDEEP
1536:JJvJnBpwdaMIOOnToIfiV6pdQcTUga/oOHo:JJvxKaCqTBfiooXgWoOH
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\DIANTZ.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\COMP.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\CONVERT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\MSPAINT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\WBEM\WINMGMT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\NETSH.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\SXSTRACE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\HDWWIZ.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\RELOG.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL_ISE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\KTMUTIL.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\SECINIT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\CTTUNESVR.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\DISM\DISMHOST.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\FTP.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\SNDVOL.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\OSK.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\REAGENTC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\SHUTDOWN.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\RUNLEGACYCPLELEVATED.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\SDBINST.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\TASKMGR.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\ISCSICPL.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\TASKMGR.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\WAITFOR.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\IPCONFIG.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\UNREGMP2.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\CACLS.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\CMDKEY.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\NETBTUGC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\SFC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\SHRPUBW.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\CHOICE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\PATHPING.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\PERFHOST.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\PRINT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\SDBINST.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\SHRPUBW.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\CHOICE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\BRMFCMF.INF_AMD64_NEUTRAL_67B5984F8E8FF717\BRMFRSMG.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\BRMFCWIA.INF_AMD64_NEUTRAL_817B8835AED3D6B7\BRMFRSMG.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\SETUP16.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\DEVICEPAIRINGWIZARD.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\VSSADMIN.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\CHKNTFS.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\CMMON32.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\SRDELAYED.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\USERACCOUNTCONTROLSETTINGS.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\DPISCALING.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\EXTRAC32.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\REKEYWIZ.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\PING.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\NSLOOKUP.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESCOMPUTERNAME.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\WRITE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\ICARDAGT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\NAPSTAT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\SYSTEMPROPERTIESHARDWARE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\NETIOUGC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\ARP.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\DNSCACHEUGC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\MIGWIZ\POSTMIG.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SYSWOW64\NETIOUGC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\SysWOW64\TPMINIT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\SETLANG.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME_PROXY.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JMC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JVISUALVM.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\SPIDERSOLITAIRE\SPIDERSOLITAIRE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSOSYNC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\HEARTS\HEARTS.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACROTEXTEXTRACTOR.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DISABLEDGOOGLEUPDATE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KLIST.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ADOBECOLLABSYNC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE AIR\VERSIONS\1.0\TEMPLATE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSPUB.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\PURBLE PLACE\PURBLEPLACE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGIN-CONTAINER.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JCMD.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JPS.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\SCHEMAGEN.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\KLIST.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\EXTCHECK.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\XJC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\LIB\VISUALVM\PLATFORM\LIB\NBEXEC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\EXTEXPORT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSTORE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\SCANPST.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JINFO.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVAWS.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\SSVAGENT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\OFFICE SETUP CONTROLLER\ODEPLOY.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\MIP.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPSHARE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\MOZILLA MAINTENANCE SERVICE\MAINTENANCESERVICE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVA-RMI.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\ORBD.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MULTIPLAYER\CHECKERS\CHKRZM.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\MPCMDRUN.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPSIDESHOWGADGET.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\ORBD.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\TNAMESERV.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\EULA.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAW.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\RMIREGISTRY.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC-CACHE-GEN.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IELOWUTIL.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAR.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\SMART TAG\SMARTTAGINSTALL.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\NOTIFICATION_HELPER.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\RMID.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\RMIREGISTRY.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\FREECELL\FREECELL.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\KEYTOOL.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\WSIMPORT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\MSOICONS.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\OUTLOOK.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MINIDUMP-ANALYZER.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\MIP.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..EOPTIONALCOMPONENTS_31BF3856AD364E35_8.0.7601.17514_NONE_7A9A2F07E4E23A48\CONFIGUREIEOPTIONALCOMPONENTS.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-VERCLSID_31BF3856AD364E35_6.1.7600.16385_NONE_17DBC2DD2D2552C7\VERCLSID.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-JSC_B03F5F7F11D50A3A_6.1.7600.16385_NONE_14E6E9DAB736481D\JSC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BCDBOOT-CMDLINETOOL_31BF3856AD364E35_6.1.7601.17514_NONE_BF7BEA0454C3F0CF\BCDBOOT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ICM-DCCW_31BF3856AD364E35_6.1.7600.16385_NONE_76E39D87A834545E\DCCW.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MAPI_31BF3856AD364E35_6.1.7601.17514_NONE_097346BE305F3966\FIXMAPI.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-SPP-UX_31BF3856AD364E35_6.1.7601.17514_NONE_B9E7A42AB571BBB9\SLUI.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_INSTALLUTIL_B03F5F7F11D50A3A_6.1.7601.17514_NONE_0826BE6CC9481DF4\INSTALLUTIL.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-F..CLIENT-APPLICATIONS_31BF3856AD364E35_6.1.7601.17514_NONE_D71FB1D63F05EF22\WFS.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TAKEOWN_31BF3856AD364E35_6.1.7601.17514_NONE_58116B392C3DA43C\TAKEOWN.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\JSC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGTLIBV12.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-IEDIAG_31BF3856AD364E35_11.2.9600.16428_NONE_F937400AA65F97CC\IEDIAGCMD.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PROQUOTA_31BF3856AD364E35_6.1.7601.17514_NONE_85ECFD46A904B22A\PROQUOTA.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMI-CONSUMERS_31BF3856AD364E35_6.1.7600.16385_NONE_A6C7190F7292676C\SCRCONS.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\FVEUPDATE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\INSTALLUTIL.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EHOME-EHVID_31BF3856AD364E35_6.1.7601.17514_NONE_A98EC3BA6B5B3E54\EHVID.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..INTEGRATION-SUPPORT_31BF3856AD364E35_6.1.7600.16385_NONE_8429BBDEBD38DB4A\ISINTSUP.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_6.1.7601.17514_NONE_90ECF919657DACF4\NETSTAT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WUSA_31BF3856AD364E35_6.1.7601.17514_NONE_0B2696EC2F3C656D\WUSA.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MCUPDATE\F30BEBA36940B5A2B55A32EA7F42D694\MCUPDATE.NI.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\INSTALLER\{90140000-0011-0000-0000-0000000FF1CE}\GRVICONS.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..LICATIONS-CLIENTSKU_31BF3856AD364E35_6.1.7601.17514_NONE_7D0125C85CC31D2A\RDPSHELL.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..ERVICING-MANAGEMENT_31BF3856AD364E35_6.1.7600.16385_NONE_BA9E94BF275D71ED\DISM.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ANYTIME-UPGRADEUI_31BF3856AD364E35_6.1.7600.16385_NONE_4AADF3BE188C056D\WINDOWSANYTIMEUPGRADEUI.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EHOME-DEVICES-MCRMGR_31BF3856AD364E35_6.1.7600.16385_NONE_901EDA10F3AB38D2\MCRMGR.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-TOOLS-SETSPN_31BF3856AD364E35_6.1.7600.16385_NONE_DBFA9310F7D4D925\SETSPN.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\INSTALLER\{90140000-0011-0000-0000-0000000FF1CE}\OISICON.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-HTMLHELP_31BF3856AD364E35_6.1.7600.16385_NONE_244AE8599E6D81BB\HH.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..AC-SQL-CLICONFG-EXE_31BF3856AD364E35_6.1.7600.16385_NONE_CC12387F7062EB3B\CLICONFG.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-NGEN_EXE_B03F5F7F11D50A3A_6.1.7601.17514_NONE_046C078DF2CAF5D8\NGEN.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_REGASM_B03F5F7F11D50A3A_6.1.7601.17514_NONE_A3C349B4BDAC0898\REGASM.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-AUTHENTICATION-LOGONUI_31BF3856AD364E35_6.1.7601.17514_NONE_C3B917FD89D834F3\LOGONUI.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..OMMANDLINEUTILITIES_31BF3856AD364E35_6.1.7600.16385_NONE_D911DF4E81059B22\FIND.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..RNETPRINTING-CLIENT_31BF3856AD364E35_6.1.7601.17514_NONE_E8F86B1CDF02C483\WPNPINST.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETHC_31BF3856AD364E35_6.1.7601.17514_NONE_C0E644688BBAD892\SETHC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\LOADMXF\6.1.0.0__31BF3856AD364E35\LOADMXF.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NGEN.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\ADDINPROCESS32.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-OS-KERNEL_31BF3856AD364E35_6.1.7601.17727_NONE_CA4E9BCDCAC7FEED\NTOSKRNL.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RASCONNECTIONMANAGER_31BF3856AD364E35_6.1.7601.17514_NONE_BD4644E077251730\CMDL32.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\NETFXSBS10.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ENCE-INFRASTRUCTURE_31BF3856AD364E35_6.1.7601.17514_NONE_3337092D63596104\SDBINST.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DPISCALING_31BF3856AD364E35_6.1.7600.16385_NONE_D63CC4DD74A11D0B\DPISCALING.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NETSH_31BF3856AD364E35_6.1.7600.16385_NONE_BB95E7E51189D8F9\NETSH.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..NPUTPERSONALIZATION_31BF3856AD364E35_6.1.7600.16385_NONE_9BA1049CE0053BEF\INPUTPERSONALIZATION.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RECDISC-MAIN_31BF3856AD364E35_6.1.7601.17514_NONE_E2A1FFE0CA40CFF2\RECDISC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-TOOLS-KSETUP_31BF3856AD364E35_6.1.7600.16385_NONE_7861B83567D966E6\KSETUP.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\REGASM.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DIRECTSHOW-DVDUPGRD_31BF3856AD364E35_6.1.7600.16385_NONE_D9BB586FF6564BBC\DVDUPGRD.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ERRORREPORTINGFAULTS_31BF3856AD364E35_6.1.7601.17514_NONE_CE2D22115368DB7A\WERFAULTSECURE.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NFS-CLIENTCMDTOOLS_31BF3856AD364E35_6.1.7600.16385_NONE_AD5854CA0A23343D\MOUNT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_WP.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EHOME-EHPRIVJOB_31BF3856AD364E35_6.1.7601.17514_NONE_53393627486AE37B\EHPRIVJOB.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGSVCS.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETUP-COMPONENT_31BF3856AD364E35_6.1.7601.17514_NONE_905283BDC3E1D2D8\SETUP.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETX_31BF3856AD364E35_6.1.7600.16385_NONE_086BC77632C16995\SETX.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TAPISETUP_31BF3856AD364E35_6.1.7600.16385_NONE_C5E81C6AB4DB0C88\TAPIUNATTEND.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_BRMFCWIA.INF_31BF3856AD364E35_6.1.7600.16385_NONE_11493A3982B640B7\BRMFRSMG.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ION-TELEMETRY-AGENT_31BF3856AD364E35_6.1.7601.17514_NONE_3092574C7D41010B\AITAGENT.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COM-DTC-RUNTIME_31BF3856AD364E35_6.1.7600.16385_NONE_7547F48C79B40229\MSDTC.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DEVICEPROPERTIES_31BF3856AD364E35_6.1.7600.16385_NONE_463F54AA539A0B62\DEVICEPROPERTIES.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PERFORMANCETOOLSGUI_31BF3856AD364E35_6.1.7601.17514_NONE_FA2FC39AB7937A51\RESMON.EXE 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe"C:\Users\Admin\AppData\Local\Temp\128b7373fd3eb7251a79298e60a9d8d7fff406a4f2e1757b53e87664f2ff97f1N.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2724