Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-10-2024 04:09
Static task
static1
Behavioral task
behavioral1
Sample
5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe
Resource
win7-20240903-en
General
-
Target
5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe
-
Size
92KB
-
MD5
5224a6b30eaf4ea7b7b4b78b0ac7ab60
-
SHA1
abf2372224b7a7700cf3cf036afee3c7789fe02d
-
SHA256
5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15
-
SHA512
888168be4d359d32de7b19cb8cd7c5428e271832d6f7cb3a216025f1ad91be8c3de8f4b7845e37245b0f63adba568ce1adaad96413302ab4123b77a90e00123a
-
SSDEEP
1536:RHB0UxMkzOt7HcvJGt5AdHIOWnToIf12ZqTUgapJ5ouH4o:RhAWJGSCTBf12Z1gsJ5og4
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SYSWOW64\MRINFO.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\RECOVER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\SECINIT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\NETPLWIZ.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\FORFILES.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\POWERCFG.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\GPRESULT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\MSRA.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\IPCONFIG.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\NETSH.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\RMACTIVATE_ISV.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\FINGER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\WIMSERV.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\CHKNTFS.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\DPAPIMIG.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\WERFAULT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\CERTUTIL.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\FONTVIEW.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\PATHPING.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\OCSETUP.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\OPTIONALFEATURES.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\PKGMGR.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\WEVTUTIL.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\FIXMAPI.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\DISPLAYSWITCH.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\RMCLIENT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\CLICONFG.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\DLLHST3G.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\PATHPING.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\SCHTASKS.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\WININIT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\DVDUPGRD.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\OPENFILES.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\REGEDIT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\COMPACT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\USERACCOUNTCONTROLSETTINGS.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\RELOG.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\BOOTCFG.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP10\IMJPUEX.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\PCAUI.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\CMD.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\NAPSTAT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\ODBCCONF.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\REGINI.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\WIAACMGR.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\COM\MIGREGDB.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\DCCW.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\NETSTAT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\PERFHOST.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\WHERE.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\WIAACMGR.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\ARP.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\ICACLS.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\IPCONFIG.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\SECEDIT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\DIANTZ.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\PRINTUI.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\SYSKEY.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SYSWOW64\WINRSHOST.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\WINRSHOST.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\FSUTIL.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\HH.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\ISCSICLI.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\SysWOW64\MSTSC.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\MPCMDRUN.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\DW\DWTRIG20.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\TEXTCONV\WKSCONV\WKCONV.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IELOWUTIL.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\GROOVE.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEINSTAL.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\SSVAGENT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KLIST.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\DEFAULT-BROWSER-AGENT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PRIVATE_BROWSING.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNETWK.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\A3DUTILITY.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTA\8.0\X86\VSTA_EP32.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\EXTCHECK.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEDIAGCMD.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JVISUALVM.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\CHROME_PWA_LAUNCHER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KINIT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JP2LAUNCHER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UPDATER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPENC.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\LOGTRANSPORT2.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\VPREVIEW.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\DVD MAKER\DVDMAKER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAH.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE AIR\VERSIONS\1.0\ADOBE AIR APPLICATION INSTALLER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\UNPACK200.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\UPDATER6\ADOBE_UPDATER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\PIPANEL.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPRPH.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPSVC.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVA.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MULTIPLAYER\SPADES\SHVLZM.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACRORD32INFO.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATEBROKER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSTORE.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\APT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\ORBD.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\UPDATER6\ADOBEUPDATERINSTALLMGR.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\OFFICE SETUP CONTROLLER\SETUP.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLECRASHHANDLER64.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATECOMREGISTERSHELL64.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DISABLEDGOOGLEUPDATE.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\GROOVEMN.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVADOC.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\LIB\LAUNCHER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAC.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVAWS.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WABMIG.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVA-RMI.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\HEARTS\HEARTS.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPRPH.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSOHTMED.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\WINWORD.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WAB.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAFXPACKAGER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\FREECELL\FREECELL.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\SPIDERSOLITAIRE\SPIDERSOLITAIRE.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE_INSTALLER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CONVERT_31BF3856AD364E35_6.1.7601.17514_NONE_FAFB502ABEF1BE40\AUTOCONV.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TASKLIST_31BF3856AD364E35_6.1.7600.16385_NONE_843823D87402AB36\TASKLIST.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-VSSADMIN_31BF3856AD364E35_6.1.7600.16385_NONE_207247174B54AF00\VSSADMIN.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WRP-INTEGRITY-CLIENT_31BF3856AD364E35_6.1.7600.16385_NONE_8733BEE404F7386C\SFC.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-AUTHENTICATION-LOGONUI_31BF3856AD364E35_6.1.7601.17514_NONE_C3B917FD89D834F3\LOGONUI.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_6.1.7601.17514_NONE_90ECF919657DACF4\FINGER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-APPLAUNCH_EXE_B03F5F7F11D50A3A_6.1.7601.17514_NONE_51E5E402131AFC4A\APPLAUNCH.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\WSATCONFIG\3.0.0.0__B03F5F7F11D50A3A\WSATCONFIG.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ILASM.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COM-SURROGATE_31BF3856AD364E35_6.1.7600.16385_NONE_A018E05D0D33081D\DLLHOST.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP_31BF3856AD364E35_6.1.7601.17514_NONE_BFAB9B4BA5F934F9\NETIOUGC.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\EHOME\EHPRIVJOB.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\IEEXEC.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_STATE.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TZUTIL_31BF3856AD364E35_6.1.7601.17514_NONE_9269DA4819C69A89\TZUTIL.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ADDINUTIL.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..ONWIZARDAPPLICATION_31BF3856AD364E35_6.1.7601.17514_NONE_18A11C58AAF4D08C\MIGWIZ.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PING-UTILITIES_31BF3856AD364E35_6.1.7600.16385_NONE_052696AEA98BCEFC\PING.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_BRMFCWIA.INF_31BF3856AD364E35_6.1.7600.16385_NONE_11493A3982B640B7\BRMFRSMG.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EHOME-EHPRIVJOB_31BF3856AD364E35_6.1.7601.17514_NONE_53393627486AE37B\EHPRIVJOB.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..MES-SPIDERSOLITAIRE_31BF3856AD364E35_6.1.7600.16385_NONE_DEAD260D8F002B73\SPIDERSOLITAIRE.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WCF-M_SM_CFG_INS_EXE_31BF3856AD364E35_6.1.7601.17514_NONE_5E47617F33C574AC\SMCONFIGINSTALLER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MSPAINT_31BF3856AD364E35_6.1.7600.16385_NONE_EA12784C0842BFC1\MSPAINT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-REGISTRY-EDITOR_31BF3856AD364E35_6.1.7600.16385_NONE_5023A70BF589AD3E\REGEDIT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SERVICEMODELREG.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COMMANDLINEHELP_31BF3856AD364E35_6.1.7600.16385_NONE_3020274B22E8A90F\HELP.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ERRORREPORTINGFAULTS_31BF3856AD364E35_6.1.7601.17514_NONE_CE2D22115368DB7A\WERFAULTSECURE.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-GC-REGISTERIEPKEYS_31BF3856AD364E35_11.2.9600.16428_NONE_0A3FE92B38DD8C45\REGISTERIEPKEYS.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\CHGLOGON.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-MSCORSVW_EXE_B03F5F7F11D50A3A_6.1.7600.16385_NONE_ACD03D9B9048BD78\MSCORSVW.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\APPLAUNCH.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-G..POLICY-CMDLINETOOLS_31BF3856AD364E35_6.1.7600.16385_NONE_975DF0A6F5A54628\GPUPDATE.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-N..PROTECTION-STATUSUI_31BF3856AD364E35_6.1.7600.16385_NONE_998FF5C741AE3FB1\NAPSTAT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PCWDIAGNOSTIC_31BF3856AD364E35_6.1.7600.16385_NONE_5120BF8B19591AFA\PCWRUN.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\COMSVCCONFIG\3.0.0.0__B03F5F7F11D50A3A\COMSVCCONFIG.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SNMP-TRAP-SERVICE_31BF3856AD364E35_6.1.7600.16385_NONE_2B7FF0845918E12F\SNMPTRAP.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-IEXPRESS_31BF3856AD364E35_11.2.9600.16428_NONE_46D2EFEF53C02386\WEXTRACT.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..OXGAMES-PURBLEPLACE_31BF3856AD364E35_6.1.7600.16385_NONE_622070221822EB39\PURBLEPLACE.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\RESET.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGIIS.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMCONFIGINSTALLER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DNS-CLIENT_31BF3856AD364E35_6.1.7601.17514_NONE_4008824C98F8EDAC\DNSCACHEUGC.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FILTERMANAGER-UTILS_31BF3856AD364E35_6.1.7600.16385_NONE_7582A4A93F08B488\FLTMC.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\EHOME\MCRMGR.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MSINFO32-EXE_31BF3856AD364E35_6.1.7601.17514_NONE_0A026C46104DD379\MSINFO32.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..-DOWNLEVEL.BINARIES_31BF3856AD364E35_6.3.9600.16428_NONE_5FAF8886FF3D65D0\MSSPELLCHECKINGFACILITY.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINPROCESS32.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\SERVICEMODELREG.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-E..OTOCOL-HOST-SERVICE_31BF3856AD364E35_6.1.7600.16385_NONE_E63ED98817CF16B1\EAP3HOST.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-GETTINGSTARTED_31BF3856AD364E35_6.1.7600.16385_NONE_DC7256ED0DED6C12\GETTINGSTARTED.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_32\EHEXTHOST32\6.1.0.0__31BF3856AD364E35\EHEXTHOST32.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_COMPILER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMSVCHOST.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\INSTALLUTIL.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-CORE_31BF3856AD364E35_6.1.7601.17514_NONE_698FC88E65B943D6\WMPLAYER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RPC-LOCATOR_31BF3856AD364E35_6.1.7600.16385_NONE_2B2984D40648FBE7\LOCATOR.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWSSEARCHENGINE_31BF3856AD364E35_7.0.7601.17514_NONE_D18028273214FA77\SEARCHINDEXER.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-AUTOPLAY_31BF3856AD364E35_6.1.7601.17514_NONE_7920B60D569A4A1E\WMLAUNCH.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..SOR-NATIVE-WHITEBOX_31BF3856AD364E35_6.1.7601.17514_NONE_FF1B74D24817A82B\RMACTIVATE.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NETPLWIZ-EXE_31BF3856AD364E35_6.1.7600.16385_NONE_494BA66D2A12EFC3\NETPLWIZ.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\QAPPSRV.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMPDMC-UX_31BF3856AD364E35_6.1.7601.17514_NONE_4C8976380E00631F\WMPDMC.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..OMMANDLINEUTILITIES_31BF3856AD364E35_6.1.7600.16385_NONE_D911DF4E81059B22\REPLACE.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IPCONFIG_31BF3856AD364E35_6.1.7600.16385_NONE_A82EE2A7319FA8F8\IPCONFIG.EXE 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe"C:\Users\Admin\AppData\Local\Temp\5038a6d7276bdab8d918dc31135e1a8b9567978f2bff2b8440985c35581a9b15N.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2584