Analysis
- max time kernel
95s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 10:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
120 seconds
General
- Target d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe
- Size 48KB
- Sample241109-mw6ltsshqp
- SHA256 d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177
- MD5 25b8bb713d44a77e864860aba0b78d50
- SHA1 5217a749c3235565915c1092fb80b209ab08dfff
- SHA512 1f3507c9e2f9732fd0e42687136150d5a4188b9bf9d55662f1024672577128555fa31d09a4c9f865daf11cc15df034106c5c1c779c2e1095f43fd7cc35d5a8ba
- SSDEEP 768:pwv4s7UUpOvj8u4Mf4MMRt4Mtx6doKihJyJmMJeg+NhTYioRokqU1p:pwvvoqO4uP875yJcg+Nook/p
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\CLOUDNOTIFICATIONS.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPDCT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\INFDEFAULTINSTALL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\REGEDT32.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\BOOTCFG.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\CALC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\INPUTSWITCHTOASTHANDLER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\NETSH.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\RASAUTOU.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\RRINSTALLER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\SORT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WINMGMT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\AT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\CONTROL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMCCPHR.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\LOGAGENT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\MAKECAB.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\ESENTUTL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\HOSTNAME.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\FONDUE.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\NETIOUGC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\PRINT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\REGINI.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\REGISTER-CIMPROVIDER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_SSP_ISV.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\DISKPERF.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\DPISCALING.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\WOWREG32.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\WSCADMINUI.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\STORDIAG.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERPT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\NETCFGNOTIFYOBJECTHOST.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\POWERCFG.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\THUMBNAILEXTRACTIONHOST.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\USERINIT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\WERMGR.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\EUDCEDIT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\FIXMAPI.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\MSTSC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\REGSVR32.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\DPLAYSVR.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\FONTDRVHOST.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\RECOVER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\CHKNTFS.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\DRIVERQUERY.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\FORFILES.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\ICSUNATTEND.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\SYNCHOST.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\USER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\CAMERASETTINGSUIHOST.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNESVR.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\TIMEOUT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\WHOAMI.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\DIALER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\SPEECH_ONECORE\COMMON\SPEECHMODELDOWNLOAD.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPERFORMANCE.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\BACKGROUNDTRANSFERHOST.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\BYTECODEGENERATOR.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\PERFHOST.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESCOMPUTERNAME.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\DEVICEPAIRINGWIZARD.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\NDADMIN.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SysWOW64\POQEXEC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\CLIENT\APPVDLLSURROGATE32.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOUC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH\JAVA.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\MICROSOFTEDGEUPDATE.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\INPUTPERSONALIZATION.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\123.0.6312.123\NOTIFICATION_HELPER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME_PROXY.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JINFO.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KINIT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH\JAVAW.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.371\GOOGLECRASHHANDLER64.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MAVINJECT32.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT ANALYSIS SERVICES\AS OLEDB\140\SQLDUMPER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WEBMEDIAEXTENSIONS_1.0.20875.0_X64__8WEKYB3D8BBWE\MICROSOFT.WEBMEDIAEXTENSIONS.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSCAMERA_2018.826.98.0_X64__8WEKYB3D8BBWE\WINDOWSCAMERA.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\POWERPNT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SDXHELPERBGT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\WINDOWS NT\ACCESSORIES\WORDPAD.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\DOTNET\DOTNET.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\TNAMESERV.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\POLICYTOOL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\SERVERTOOL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXAPP_48.49.31001.0_X64__8WEKYB3D8BBWE\XBOXAPP.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.ZUNEVIDEO_10.19071.19011.0_X64__8WEKYB3D8BBWE\VIDEO.UI.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ARH.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\READER_SL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE_INSTALLER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.YOURPHONE_0.19051.7.0_X64__8WEKYB3D8BBWE\YOURPHONE.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.147.37\MICROSOFTEDGEUPDATE.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JABSWITCH.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAWS.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVAWS.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SELFCERT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OSMADMINICON.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROTEXTEXTRACTOR.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JHAT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVA.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVAW.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOADFSB.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSSTORE_11910.1002.5.0_X64__8WEKYB3D8BBWE\WINSTORE.APP.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\WOW_HELPER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\RMID.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KTAB.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SERVERTOOL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UPDATER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPRPH.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\MIP.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\123.0.6312.123\INSTALLER\SETUP.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVA.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOSREC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEINSTAL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SSVAGENT.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVA.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\MISC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.371\GOOGLEUPDATE.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SKYPESRV\SKYPESERVER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32INFO.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OFFICECLICKTORUN.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IELOWUTIL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAW.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOASB.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_ADDINPROCESS32_B77A5C561934E089_10.0.19041.1_NONE_3700BDC08C446A5C\ADDINPROCESS32.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\ADDINPROCESS.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\EDMGEN.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_REGIIS.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_REGSQL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\WFSERVICESREG.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CVTRES.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\HH.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WPF\XAMLVIEWER\XAMLVIEWER_V0300.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_REGSQL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\DATASVCUTIL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_WP.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMSVCHOST.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\WOW_HELPER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\VBC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INPUTAPP\TEXTINPUTHOST.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\VBC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINPROCESS.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\COMSVCCONFIG.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\COMSVCCONFIG\V4.0_4.0.0.0__B03F5F7F11D50A3A\COMSVCCONFIG.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DFSVC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORSVW.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\JSC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4BITMAPIBROKER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_COMPILER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.CALLINGSHELLAPP_CW5N1H2TXYEWY\CALLINGSHELLAPP.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\DFSVC\V4.0_4.0.0.0__B03F5F7F11D50A3A\DFSVC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\INSTALLUTIL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.STARTMENUEXPERIENCEHOST_CW5N1H2TXYEWY\STARTMENUEXPERIENCEHOST.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADDINPROCESS_B77A5C561934E089_4.0.15805.0_NONE_74BABA51266F3010\ADDINPROCESS.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADOBE-FLASH-FOR-WINDOWS_31BF3856AD364E35_10.0.19041.82_NONE_2358A116979CC599\FLASHUTIL_ACTIVEX.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_WP.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NGEN.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.ADDSUGGESTEDFOLDERSTOLIBRARYDIALOG_CW5N1H2TXYEWY\ADDSUGGESTEDFOLDERSTOLIBRARYDIALOG.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.XGPUEJECTDIALOG_CW5N1H2TXYEWY\XGPUEJECTDIALOG.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINPROCESS32.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\BFSVC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MICROSOFT.WORKFLOW.COMPILER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\APPLAUNCH.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\INSTALLUTIL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\DATASVCUTIL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGASM.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\MSBUILD.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.APPRESOLVERUX_CW5N1H2TXYEWY\APPRESOLVERUX.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\PRESENTATIONFONTCACHE\3.0.0.0__31BF3856AD364E35\PRESENTATIONFONTCACHE.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\MICROSOFT.WORKFLOW.COMPILER\V4.0_4.0.0.0__31BF3856AD364E35\MICROSOFT.WORKFLOW.COMPILER.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGBROWSERS.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGIIS.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\JSC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DFSVC.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\SMSVCHOST.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\SPEECH\COMMON\SAPISVR.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADDINPROCESS32_B77A5C561934E089_4.0.15805.0_NONE_FAEE98A3C711FAE7\ADDINPROCESS32.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_REGSQL_B03F5F7F11D50A3A_4.0.15805.0_NONE_AADF84CDA75DA02D\ASPNET_REGSQL.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ADELRCP.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CVTRES.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGSVCS.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\SERVICEMODELREG.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_BSDTAR_31BF3856AD364E35_10.0.19041.1_NONE_0C1F19C50B5E5F6E\TAR.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_REGBROWSERS_B03F5F7F11D50A3A_4.0.15805.0_NONE_646D7347043BE71C\ASPNET_REGBROWSERS.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCORSVW.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_REGBROWSERS.EXE d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3792 d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe"C:\Users\Admin\AppData\Local\Temp\d001187ac1de0c15bc25f58c39d09bc3d5cce79437dd9e1626eebe55e2236177N.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3792