04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665

Analysis

max time kernel
118s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
Size

3.2MB
MD5

b3ed8f8fb803c8553e687549fbdd0716
SHA1

6046bd54ac6b2b39e2b13d2d16ddf91a3776551f
SHA256

04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665
SHA512

9ab330a680c0d10a77cc57c96a4d271dc9184533a61d84fac5e1d404eba592b015b55cd5548deb1cc1d3c4417f1798c429d7d74a8432a928c46e9b4d4b9ef11c
SSDEEP

49152:SqFfR6WI8gT2YlmlxsqFMsqFfR6WI8gT2YlmldnTJzqnstLet3LyTEp63:DR6BtltR6BtlyqnstLErpC

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{CA9E0780-5A2C-43F8-9E63-52BCB11A02D4}\chrome_installer.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{CA9E0780-5A2C-43F8-9E63-52BCB11A02D4}\chrome_installer.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe

Drops file in Windows directory 50 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1180	04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe

C:\Users\Admin\AppData\Local\Temp\04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe
"C:\Users\Admin\AppData\Local\Temp\04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\905c0769f9a06c95a24ddf945\patcher.exe$

Filesize
3.2MB

MD5
b3ed8f8fb803c8553e687549fbdd0716

SHA1
6046bd54ac6b2b39e2b13d2d16ddf91a3776551f

SHA256
04150b33412c9086b8f1a94cbe1799ad59996cf8bb11d1d539b6c91ed4649665

SHA512
9ab330a680c0d10a77cc57c96a4d271dc9184533a61d84fac5e1d404eba592b015b55cd5548deb1cc1d3c4417f1798c429d7d74a8432a928c46e9b4d4b9ef11c

Download Submit
memory/1180-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1180-1623-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads