Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/11/2024, 22:02
Static task
static1
Behavioral task
behavioral1
Sample
424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe
Resource
win7-20240903-en
General
-
Target
424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe
-
Size
92KB
-
MD5
635066b619008b0d673ca5c780db3764
-
SHA1
a8c8c6b82d4f6bdd30451de7e129750678f131a1
-
SHA256
424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7
-
SHA512
0d49a299d1a425fbfbc4b8cdbd922692fc6a67fc5c3914f66f814e58c9d9005c90eb0b779ea368df151afc513f8bc5c7631bf5a540b142cbd1134caeaa952704
-
SSDEEP
1536:DHB0UxMkzOt7HcvJGt5AdHIOWnToIf12ZqTUgatwoHVo:DhAWJGSCTBf12Z1gfoHV
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\IEUNATT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\MSHTA.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\TAKEOWN.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\WRITE.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\PRINT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\CERTUTIL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\WINRSHOST.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\XCOPY.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\CMMON32.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\CTTUNESVR.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\FIXMAPI.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\SRDELAYED.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\WINRS.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\WSCRIPT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\FLTMC.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\IME\IMEJP10\IMJPMGR.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\MIGWIZ\POSTMIG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\IME\IMEJP10\IMJPDSVR.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\BTH.INF_AMD64_NEUTRAL_E54666F6A3E5AF91\FSQUIRT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP10\IMJPPDMG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\NDADMIN.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\TIMEOUT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\DISM.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\MOUNTVOL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\USERINIT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\DPAPIMIG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\DVDUPGRD.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\TASKENG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\MIGWIZ\MIGSETUP.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\WBEM\WMIADAP.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\WECUTIL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\WSMANHTTPCONFIG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\NETPLWIZ.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\REAGENTC.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\VERCLSID.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\COM\MIGREGDB.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\PATHPING.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\DCOMCNFG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\DEVICEPAIRINGWIZARD.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\BRMFCMF.INF_AMD64_NEUTRAL_67B5984F8E8FF717\BRMFRSMG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP10\IMJPDSVR.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\SYSKEY.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\DPNSVR.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\RMACTIVATE_ISV.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\SORT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\LOCATIONNOTIFICATIONS.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\MSPAINT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\NTKRNLPA.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\OSK.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\RUNLEGACYCPLELEVATED.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\FIXMAPI.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\FORFILES.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_ISV.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\WAITFOR.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\GPUPDATE.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL_ISE.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\CLICONFG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\GPRESULT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\ICACLS.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SysWOW64\MSIEXEC.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\CACLS.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\DCOMCNFG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\PERFMON.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SYSWOW64\RESMON.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVAWS.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVACPL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\WINDOWS NT\ACCESSORIES\WORDPAD.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\ONENOTE.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPSHARE.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSTORE.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAC.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JSTATD.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JP2LAUNCHER.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\WINDOWS JOURNAL\JOURNAL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSQRY32.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVA-RMI.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\TNAMESERV.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE_INSTALLER.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVA-RMI.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DISABLEDGOOGLEUPDATE.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAFXPACKAGER.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KTAB.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\HEARTS\HEARTS.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTA\8.0\X86\VSTA_EP32.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\WSIMPORT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MULTIPLAYER\SPADES\SHVLZM.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\SERVERTOOL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KLIST.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WABMIG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\RMID.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\INKWATSON.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JDB.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\KEYTOOL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\KTAB.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\DEFAULT-BROWSER-AGENT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\MOZILLA MAINTENANCE SERVICE\MAINTENANCESERVICE.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\BCSSYNC.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\RMID.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\DW\DW20.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\MSOXMLED.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\SHAPECOLLECTOR.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\INSTALLER\SETUP.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WINMAIL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATESETUP.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\DVD MAKER\DVDMAKER.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC-CACHE-GEN.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\SETLANG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\SCHEMAGEN.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JP2LAUNCHER.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\SSVAGENT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IELOWUTIL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\OIS.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\NOTIFICATION_HELPER.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\APPLETVIEWER.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KEYTOOL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\ORBD.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAW.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MULTIPLAYER\BACKGAMMON\BCKGZM.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\SSVAGENT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\DW\DWTRIG20.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\FLICKLEARNINGWIZARD.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\WFSERVICESREG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-GC-REGISTERIEPKEYS_31BF3856AD364E35_8.0.7601.17514_NONE_A0C922C3B170DD5D\REGISTERIEPKEYS.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-INFDEFAULTINSTALL_31BF3856AD364E35_6.1.7600.16385_NONE_C8897566B5C070A0\INFDEFAULTINSTALL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CVTRES.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..TING-TOOLS-PRINTBRM_31BF3856AD364E35_6.1.7601.17514_NONE_DFE02DE35BF41E0B\PRINTBRMUI.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WAB-APP_31BF3856AD364E35_6.1.7601.17514_NONE_A0CF62EFEE3228A3\WABMIG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_SUBSYSTEM-FOR-UNIX-BASED-APPLICATIONS_31BF3856AD364E35_6.1.7601.17514_NONE_D20E5D35068F261A\PSXSS.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSBUILD\AF28543D9B3E7D9F110448ECCE53CD72\MSBUILD.NI.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\CHGUSR.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TIMEOUT_31BF3856AD364E35_6.1.7600.16385_NONE_E8595E67DFF5B7F4\TIMEOUT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\SERVICING\GC64\TZUPD.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CHOICE_31BF3856AD364E35_6.1.7601.17514_NONE_218CF07BA262766C\CHOICE.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-SETUP-SUPPORT_31BF3856AD364E35_8.0.7601.17514_NONE_3EB101CAEC1ACC2C\IE4UINIT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..ONWIZARDAPPLICATION_31BF3856AD364E35_6.1.7601.17514_NONE_18A11C58AAF4D08C\MIGSETUP.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..TING-LPRPORTMONITOR_31BF3856AD364E35_6.1.7601.17514_NONE_1229A6F0546E2346\LPR.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SERVICINGSTACK_31BF3856AD364E35_6.1.7601.17514_NONE_678566B7DDEA04A5\POQEXEC.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..CATIONNOTIFICATIONS_31BF3856AD364E35_6.1.7600.16385_NONE_737951AB23CF8EA0\LOCATIONNOTIFICATIONS.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NFS-CLIENTCORE_31BF3856AD364E35_6.1.7601.17514_NONE_0B0882245933A065\NFSCLNT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGSVCS.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..PLAYER-SHELLPREVIEW_31BF3856AD364E35_6.1.7600.16385_NONE_1C92C4D88CE86757\WMPRPH.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\APPLAUNCH.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_INFOCARD_B77A5C561934E089_6.1.7601.17514_NONE_583A8C60C0B305A1\INFOCARD.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-IEETWCOLLECTOR_31BF3856AD364E35_11.2.9600.16428_NONE_A56DA9E617D4F97E\IEETWCOLLECTOR.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ISCSI_INITIATOR_UI_31BF3856AD364E35_6.1.7600.16385_NONE_33E01C5875C2E5CB\ISCSICPL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LPKSETUP_31BF3856AD364E35_6.1.7601.17514_NONE_7F7F66788318015D\LPREMOVE.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..G-XPSDOCUMENTWRITER_31BF3856AD364E35_6.1.7601.17514_NONE_80FEA45979A5D3F2\MXDWGC.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SCRIPTING_31BF3856AD364E35_6.1.7600.16385_NONE_A45D44BD1A0AF822\WSCRIPT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DATASVCUTIL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DEPLOYMENT_31BF3856AD364E35_6.1.7600.16385_NONE_57E3E87206FF08CA\SETUPUGC.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-F..TEMCOMPAREUTILITIES_31BF3856AD364E35_6.1.7600.16385_NONE_5CBB962A4F0D58C1\FC.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TABLETPC-CONTROLPANEL_31BF3856AD364E35_6.1.7601.17514_NONE_3D9977977190CDC4\MULTIDIGIMON.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-CLRGC_B03F5F7F11D50A3A_6.1.7601.17514_NONE_AD7A390FA131C970\CLRGC.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\EHOME\EHSCHED.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FORFILES_31BF3856AD364E35_6.1.7600.16385_NONE_B1186146F739D0F1\FORFILES.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..OPERTIESPERFORMANCE_31BF3856AD364E35_6.1.7600.16385_NONE_B6CB9ED71C8B43D5\SYSTEMPROPERTIESPERFORMANCE.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CONSOLEHOST_31BF3856AD364E35_6.1.7601.17932_NONE_D26A33EC18CB49C4\CONHOST.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RUNONCE_31BF3856AD364E35_6.1.7601.17514_NONE_73E0DA0BD5A77C41\RUNONCE.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\ADDINPROCESS32.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CSC.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-E..OTOCOL-HOST-SERVICE_31BF3856AD364E35_6.1.7600.16385_NONE_E63ED98817CF16B1\EAP3HOST.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..NCETOOLSCOMMANDLINE_31BF3856AD364E35_6.1.7601.17514_NONE_BF4980401574A899\TRACERPT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..UNTERINFRASTRUCTURE_31BF3856AD364E35_6.1.7600.16385_NONE_CD7AEEFF1897D018\LODCTR.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TELNET-SERVER_31BF3856AD364E35_6.1.7600.16385_NONE_EEFCCE9868C6D4B7\TLNTADMN.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\SERVICEMODELREG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..X-DIRECTXDIAGNOSTIC_31BF3856AD364E35_6.1.7601.17514_NONE_81E99DA174638311\DXDIAG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-SYSKEY_31BF3856AD364E35_6.1.7600.16385_NONE_74578A893F33207C\SYSKEY.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WCF-SMSVCHOST_B03F5F7F11D50A3A_6.1.7600.16385_NONE_C7F13AF70AC77B22\SMSVCHOST.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EHOME-DEVICES-MCX2PROV_31BF3856AD364E35_6.1.7600.16385_NONE_3482237B32C1DAFF\MCX2PROV.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-INTERNETEXPLORER_31BF3856AD364E35_11.2.9600.16428_NONE_11B913172F0CB26F\IEUNATT.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..OMMANDLINEUTILITIES_31BF3856AD364E35_6.1.7600.16385_NONE_D911DF4E81059B22\DOSKEY.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-CORE_31BF3856AD364E35_6.1.7601.17514_NONE_698FC88E65B943D6\WMPCONFIG.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_64\MSBUILD\3.5.0.0__B03F5F7F11D50A3A\MSBUILD.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IIS-MANAGEMENTCONSOLE_31BF3856AD364E35_6.1.7600.16385_NONE_E3C88F07D4C88269\INETMGR.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MAIL-APP_31BF3856AD364E35_6.1.7601.17514_NONE_4F7E32F76654BD3C\WINMAIL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\ADDINPROCESS.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WPD-SHELLEXTENSION_31BF3856AD364E35_6.1.7601.17514_NONE_6F4EF219DD693CA6\WPDSHEXTAUTOPLAY.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\SMSVCHOST\3.0.0.0__B03F5F7F11D50A3A\SMSVCHOST.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGBROWSERS.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CASPOL.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..BOXGAMES-BACKGAMMON_31BF3856AD364E35_6.1.7600.16385_NONE_668D031845881638\BCKGZM.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\ADDINPROCESS32.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DIRECTSHOW-DVDPLAY_31BF3856AD364E35_6.1.7600.16385_NONE_5DA314D233BB2676\DVDPLAY.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SHAREDACCESS_31BF3856AD364E35_6.1.7600.16385_NONE_60C2504D62FD4F0E\ICSUNATTEND.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..VIRONMENT-OS-LOADER_31BF3856AD364E35_6.1.7601.17514_NONE_B94CBFA183466A89\WINLOAD.EXE 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe"C:\Users\Admin\AppData\Local\Temp\424cce0ed667aff2ade14ed386884188c4f14fecaf5b810d313407dbcb0953b7.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2508