eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225

General

Target

eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
Size

4.7MB
MD5

a4b519b37844d51ed698216f3ce096d4
SHA1

7d7c671e7fbde7913d6c5bf6bf47e763d1ceb23c
SHA256

eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225
SHA512

032760e9795b5e1b50fc58c1a44af96369f48905e3b1dfcf843d30c4ed011b2169e95fbc28bbaf247d3978b5ecadc10627ff684d6f8375a3f6d504978d52131c
SSDEEP

98304:wVHKSERbPVHjVHKSERbPSERbPVHjVHKSERbPSERbY:U

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

Drops file in System32 directory 64 IoCs

Processes:

eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ARP.EXE	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\instnm.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\CheckNetIsolation.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\newdev.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\setup16.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\setx.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\mtstocom.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\OpenWith.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\WerFault.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\dtdump.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\dxdiag.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\fixmapi.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\fsquirt.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\sdiagnhost.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\SystemPropertiesHardware.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\wbem\WinMgmt.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\at.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\doskey.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\mobsync.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\RMActivate.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\schtasks.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\sdchange.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\tar.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\typeperf.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\verifiergui.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\MuiUnattend.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\notepad.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\WerFaultSecure.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\charmap.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\TCPSVCS.EXE	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\UserAccountBroker.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\regsvr32.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\timeout.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\autochk.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\chkntfs.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\cmdkey.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\DWWIN.EXE	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\msinfo32.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\TSTheme.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\find.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\findstr.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\makecab.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\msdt.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\pcaui.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\TokenBrokerCookies.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\wiaacmgr.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\mcbuilder.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\poqexec.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\ReAgentc.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\subst.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\wscript.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\hh.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\perfhost.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\TpmInit.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\WWAHost.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\fontdrvhost.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\HOSTNAME.EXE	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\net1.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\SysWOW64\waitfor.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

Drops file in Program Files directory 64 IoCs

Processes:

eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\7-Zip\7zFM.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

Drops file in Windows directory 64 IoCs

Processes:

eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\PrintDialog\PrintDialog.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\servicing\TrustedInstaller.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe$	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

NTFS ADS 1 IoCs

Processes:

eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

pid process

1760 eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

pid	process
1760	eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe

C:\Users\Admin\AppData\Local\Temp\eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe
"C:\Users\Admin\AppData\Local\Temp\eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\905c0769f9a06c95a24ddf945\patcher.exe$

Filesize
4.7MB

MD5
a4b519b37844d51ed698216f3ce096d4

SHA1
7d7c671e7fbde7913d6c5bf6bf47e763d1ceb23c

SHA256
eaacab1e707f3796e472badda56a24c6cc094ead73c92e9d05d3741859bd8225

SHA512
032760e9795b5e1b50fc58c1a44af96369f48905e3b1dfcf843d30c4ed011b2169e95fbc28bbaf247d3978b5ecadc10627ff684d6f8375a3f6d504978d52131c

Download Submit
memory/1760-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1760-2218-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads