Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
25/10/2024, 21:14
Static task
static1
Behavioral task
behavioral1
Sample
452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe
Resource
win7-20241023-en
General
-
Target
452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe
-
Size
92KB
-
MD5
4cd82bdf6641b6bd80b73399ed6f97bb
-
SHA1
666c9a05429d054df4f2672be12ba9caa457ac21
-
SHA256
452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191
-
SHA512
793026271da0fcb0e03fbb3d930ed04714b5a512243216450f23e9394f7e7e8338b6064c0aeb6aa8c66a9dfd859d2c4beaa71ff4b3f9ae4064ee6e5940e07dc4
-
SSDEEP
1536:DHB0UxMkzOt7HcvJGt5AdHIOWnToIf12ZqTUgafoMSo:DhAWJGSCTBf12Z1g+oMS
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\WINRS.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\UTILMAN.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\CMSTP.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\COLORCPL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\DCCW.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\DLLHST3G.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\SFC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\VSSADMIN.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\LODCTR.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\MFPMP.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\RMACTIVATE_SSP.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\XPSRCHVW.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\MSHTA.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\AUTOCONV.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\CTFMON.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\ICSUNATTEND.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\MIGWIZ\MIGHOST.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\MSINFO32.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\OPTIONALFEATURES.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\SNDVOL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\CALC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\NETBTUGC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\ODBCCONF.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\POWERCFG.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\REG.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\WUSA.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\SVCHOST.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\WPDSHEXTAUTOPLAY.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\RELOG.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\CHARMAP.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\DFRGUI.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP10\IMJPDADM.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\PATHPING.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESREMOTE.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\MSRA.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\CACLS.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\INSTALLSHIELD\_ISDEL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\REGISTERIEPKEYS.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\NTPRINT.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\DISKPART.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\SDIAGNHOST.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\TRACERPT.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\IPCONFIG.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\DCOMCNFG.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\GETMAC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\ICSUNATTEND.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\SHRPUBW.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\EHSTORAUTHN.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\KTMUTIL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\CHKNTFS.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\DEVICEPROPERTIES.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\FINDSTR.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\NTOSKRNL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\XWIZARD.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\NETSTAT.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\REG.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\SYSTEMPROPERTIESPERFORMANCE.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\IME\IMEJP10\IMJPPDMG.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\NTPRINT.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\EVENTCREATE.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SysWOW64\ODBCAD32.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\DLLHST3G.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\DPISCALING.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SYSWOW64\FORFILES.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\SERIALVER.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\WINDOWS JOURNAL\JOURNAL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\CNFNOT32.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\DVD MAKER\DVDMAKER.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\NATIVE2ASCII.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\SERVERTOOL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ADOBECOLLABSYNC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WAB.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSTORE.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JABSWITCH.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JDB.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\WSIMPORT.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVA-RMI.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC-CACHE-GEN.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\INSTALLER\CHRMSTP.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\KTAB.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\CRASHREPORTER.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPLAYER.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JP2LAUNCHER.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACROBROKER.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\OFFICE SETUP CONTROLLER\SETUP.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPENC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPRPH.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\KEYTOOL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\TNAMESERV.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\LIB\VISUALVM\PLATFORM\LIB\NBEXEC64.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MULTIPLAYER\CHECKERS\CHKRZM.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WINMAIL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\XLICONS.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\ORBD.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\RMID.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\UNPACK200.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IELOWUTIL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JVISUALVM.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVACPL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MINIDUMP-ANALYZER.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\SMART TAG\SMARTTAGINSTALL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\OIS.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\SHAPECOLLECTOR.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\GROOVEMN.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\XJC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\CHESS\CHESS.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PINGSENDER.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTA\8.0\X86\VSTA_EP32.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATEONDEMAND.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\GRAPH.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JSTACK.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPSIDESHOWGADGET.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSOSYNC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVA.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\POLICYTOOL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATEBROKER.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATECOMREGISTERSHELL64.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\OUTLOOK.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPDMC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATESETUP.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\VPREVIEW.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVA-RMI.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\IECONTENTSERVICE.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LPKSETUP_31BF3856AD364E35_6.1.7601.17514_NONE_7F7F66788318015D\LPREMOVE.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-WMPENC_31BF3856AD364E35_6.1.7600.16385_NONE_00192601418CADFF\WMPENC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WAB-APP_31BF3856AD364E35_6.1.7601.17514_NONE_A0CF62EFEE3228A3\WABMIG.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BCDBOOT-CMDLINETOOL_31BF3856AD364E35_6.1.7601.17514_NONE_BF7BEA0454C3F0CF\BCDBOOT.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ICACLS_31BF3856AD364E35_6.1.7600.16385_NONE_8EA990B7BFAB3802\ICACLS.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..PLATFORM-INPUT-CORE_31BF3856AD364E35_6.1.7601.17514_NONE_2F3651E7F36D703F\WISPTIS.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\WSATCONFIG.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINPROCESS32.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IEINSTAL_31BF3856AD364E35_11.2.9600.16428_NONE_CAF2EC2CA6B08F27\IEINSTAL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURESTARTUP-CPL_31BF3856AD364E35_6.1.7601.17514_NONE_B5AC5CC3A1B7E9EF\BITLOCKERWIZARD.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_WP.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\SERVICING\GC64\TZUPD.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMI-SNMP-PROVIDER_31BF3856AD364E35_6.1.7601.17514_NONE_08E183F8DD5F48B7\SMI2SMIR.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_6.1.7601.17514_NONE_90ECF919657DACF4\NETSTAT.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FORFILES_31BF3856AD364E35_6.1.7600.16385_NONE_B1186146F739D0F1\FORFILES.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-G..POLICY-CMDLINETOOLS_31BF3856AD364E35_6.1.7600.16385_NONE_975DF0A6F5A54628\GPUPDATE.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..PDATECLIENT-ACTIVEX_31BF3856AD364E35_7.5.7601.17514_NONE_AF500E3C7FC49BC4\WUAPP.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CTTUNESVR_31BF3856AD364E35_6.1.7600.16385_NONE_4BEFC8EB38093BB1\CTTUNESVR.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WPF-XAMLVIEWER_31BF3856AD364E35_6.1.7601.17514_NONE_B43451F0938C6CD0\XAMLVIEWER_V0300.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..-COREINKRECOGNITION_31BF3856AD364E35_6.1.7600.16385_NONE_498D334C14A3B9BB\HWRREG.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\PRESENTATIONFONTCAC#\0246845F487E5F33D3564EFF578665A3\PRESENTATIONFONTCACHE.NI.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ION-TELEMETRY-AGENT_31BF3856AD364E35_6.1.7601.17514_NONE_3092574C7D41010B\AITAGENT.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..-SETIEINSTALLEDDATE_31BF3856AD364E35_8.0.7600.16385_NONE_7F263A8951BC5A48\SETIEINSTALLEDDATE.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SERVICEPACKCOORDINATOR_31BF3856AD364E35_6.1.7601.17514_NONE_92E727843E307E1B\SPINSTALL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..-ODBC-ADMINISTRATOR_31BF3856AD364E35_6.1.7600.16385_NONE_A044D905576812D4\ODBCAD32.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETUP-COMPONENT_31BF3856AD364E35_6.1.7601.17514_NONE_905283BDC3E1D2D8\WINDEPLOY.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\WFSERVICESREG.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..IME-EASHARED-IMEPAD_31BF3856AD364E35_6.1.7601.17514_NONE_98B24799B5D08C05\IMEPADSV.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-E..AGEENGINE-UTILITIES_31BF3856AD364E35_6.1.7600.16385_NONE_3580DEA4DEF227D4\ESENTUTL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\INSTALLER\{90140000-0011-0000-0000-0000000FF1CE}\PUBS.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..-DEPLOYMENT-PACKAGE_31BF3856AD364E35_6.1.7600.16385_NONE_BAC291589D407FDE\TFTP.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-APPLAUNCH_EXE_B03F5F7F11D50A3A_6.1.7601.17514_NONE_51E5E402131AFC4A\APPLAUNCH.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EVENTCREATE_31BF3856AD364E35_6.1.7600.16385_NONE_3157C24B5944E2A3\EVENTCREATE.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-INSTALLER-EXECUTABLE_31BF3856AD364E35_6.1.7601.17514_NONE_A7A77A3B9CB96CE6\MSIEXEC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SOUNDRECORDER_31BF3856AD364E35_6.1.7601.17514_NONE_FD2F4B124982E400\SOUNDRECORDER.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WCF-ICARDAGT_EXE_31BF3856AD364E35_6.1.7600.16385_NONE_8DCC9C6F8B58A5EB\ICARDAGT.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\EHOME\LOADMXF.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_COMPILER.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FDDDO_31BF3856AD364E35_6.1.7600.16385_NONE_B0DE2AFE4CA7A1E2\DEVICEDISPLAYOBJECTPROVIDER.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\ADDINPROCESS32.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\VBC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FSUTIL_31BF3856AD364E35_6.1.7600.16385_NONE_28590620099DA2D8\FSUTIL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-OPTIONALTSPS_31BF3856AD364E35_6.1.7600.16385_NONE_3DF12FEBE293CE5D\TCMSETUP.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_COMPILER.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\SETUPCACHE\V4.7.03062\SETUP.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..UNTERINFRASTRUCTURE_31BF3856AD364E35_6.1.7600.16385_NONE_CD7AEEFF1897D018\LODCTR.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_6.1.7601.17514_NONE_90ECF919657DACF4\ROUTE.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\HH.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..WSUPDATECLIENT-CORE_31BF3856AD364E35_7.5.7601.17514_NONE_1F3413AFC64D10C5\WUAUCLT.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SYSTEMRESTORE-MAIN_31BF3856AD364E35_6.1.7601.17514_NONE_A505D556C9DE886A\RSTRUI.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WINRE-RECOVERYTOOLS_31BF3856AD364E35_6.1.7600.16385_NONE_3142C61B8ADA510F\REAGENTC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMI-CORE_31BF3856AD364E35_6.1.7601.17514_NONE_177A088436382A34\UNSECAPP.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\BITLOCKERDISCOVERYVOLUMECONTENTS\BITLOCKERTOGO.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGSQL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\REGSVCS.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RUNAS_31BF3856AD364E35_6.1.7600.16385_NONE_BBDD3AEB771E694E\RUNAS.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\INSTALLER\{90140000-0011-0000-0000-0000000FF1CE}\MISC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_REGSQL_B03F5F7F11D50A3A_6.1.7600.16385_NONE_DCB42EC76404494F\ASPNET_REGSQL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EHOME-MCWEBLAUNCHER_31BF3856AD364E35_6.1.7600.16385_NONE_5846A8771B202706\MEDIACENTERWEBLAUNCHER.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURESTARTUP-SERVICE_31BF3856AD364E35_6.1.7600.16385_NONE_C09AA5B3BEC88BEB\BDEUISRV.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-CORE_31BF3856AD364E35_6.1.7601.17514_NONE_698FC88E65B943D6\WMPSHARE.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..OMMAND-LINE-UTILITY_31BF3856AD364E35_6.1.7600.16385_NONE_FD9EC705E687F8C2\WMIC.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\INSTALLUTIL.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TASKHOST_31BF3856AD364E35_6.1.7601.18010_NONE_86608C5A70F925BC\TASKHOST.EXE 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe"C:\Users\Admin\AppData\Local\Temp\452733dc7e7cc2f2807f0b10cb6194899dc56fe0ed56140bf1bf53244c23b191.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2316