Overview
overview
10Static
static
10757e3242f6...b4.exe
windows7-x64
976fe72e0ec...ss.exe
windows7-x64
778d4cf8df6...B3.exe
windows7-x64
778d4cf8df6...59.exe
windows7-x64
778db508226...69.exe
windows7-x64
97965f6adf3...ss.exe
windows7-x64
77B75B33BCF...B5.exe
windows7-x64
17E3903944E...72.exe
windows7-x64
77dd9312307...ca.dll
windows7-x64
37e4c9a7e39...1f.exe
windows7-x64
980eb72d781...B3.exe
windows7-x64
780eb72d781...9A.exe
windows7-x64
7845263c869...c8.exe
windows7-x64
98524224187...8f.exe
windows7-x64
686be3831f5...39.exe
windows7-x64
68791931bac...DA.exe
windows7-x64
78791931bac...69.exe
windows7-x64
787a4f3f9f6...88.exe
windows7-x64
789fb6d7ff2...f6.exe
windows7-x64
98c59148535...21.exe
windows7-x64
98d372fcf8a...e0.exe
windows7-x64
7900.exe
windows7-x64
9911d5905cb...b9.exe
windows7-x64
791d24e0657...eb.zip
windows7-x64
192ac6be4d9...5b.exe
windows7-x64
97512f4617...7c.exe
windows7-x64
1098aadc95c5...e7.exe
windows7-x64
109943256.exe
windows7-x64
109B9517FA15...DF.exe
windows7-x64
79b7eaffe4d...c8.exe
windows7-x64
10a322da0be4...44.exe
windows7-x64
10a42252e674...34.exe
windows7-x64
9Analysis
-
max time kernel
840s -
max time network
841s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 02:43
Behavioral task
behavioral1
Sample
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral3
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral5
Sample
78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
7B75B33BCF4ECF013B93F84ED98B3FB5.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
7E3903944EAB7B61B495572BAA60FB72.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral9
Sample
7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral13
Sample
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral14
Sample
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral15
Sample
86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_TDS=4F84A969.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
87a4f3f9f6dc263378f2f01db5f2c988.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
8c591485357e45a09dad3116496e6f686fa11f445a6bea5ef3cd5ed1ac078821.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
8d372fcf8a97223ebb86cdfe707d3035dfbfd4501c5688cfa82a9a4889e637e0.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral22
Sample
900.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral23
Sample
911d5905cbe1dd462f171b7167cd15b9.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
91d24e06572099ba0aa5c20be6b1021fa48e864913fe3676ed05323e6b68fceb.zip
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
92ac6be4d9215b237d624177ca0543844d0dc8d071660ae4a4cf7c93cc11505b.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
97512f4617019c907cd0f88193039e7c.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral27
Sample
98aadc95c589e064a542802bbf0ef01ef00595c34d195f1a1e6443909846d2e7.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
9943256.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
9B9517FA1515F47A502FE56536236A20BE5BBADF.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
9b7eaffe4dffcbd06445d0b32785cdc8.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
a322da0be4f0be8d85eab815ca708c8452b63f24d0e2d2d6d896a9f9331a6244.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
a42252e674a09a0b689e71c88f59969f538a473da647cc4eb5457a5d5e03a234.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
87a4f3f9f6dc263378f2f01db5f2c988.exe
-
Size
630KB
-
MD5
87a4f3f9f6dc263378f2f01db5f2c988
-
SHA1
dab86879e6e423582fedab0cc00c95882d3c3417
-
SHA256
5d196e6481f38fa6657d74288fc51b91e273b62ec00100737d0d0cc8f1e8379b
-
SHA512
b2d98312e827c14702befe05c4262718a2e321a7200f1c08ddaa2517157b4fef960ba9508cec43654c77bec060c998d71f7be8e0b84633531e1cb5cd10b903e6
-
SSDEEP
12288:AzBsMGrB6kzTKOeW9dY82G+JTlJR8E4TeOb57BIAwP/wyBmrdTOVf8I6jTBwF2dO:ifGIkzGOeW9dYG0pFf0wP/wyBmrdTOVN
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1512 cmd.exe -
Drops startup file 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\87a4f3f9f6dc263378f2f01db5f2c988.exe 87a4f3f9f6dc263378f2f01db5f2c988.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pic.bmp 87a4f3f9f6dc263378f2f01db5f2c988.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\87a4f3f9f6dc263378f2f01db5f2c988.exe 87a4f3f9f6dc263378f2f01db5f2c988.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\it-IT\Licenses\eval\StarterN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\Licenses\_Default\UltimateN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\Licenses\eval\Enterprise\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\eval\Starter\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\it-IT\Licenses\eval\ProfessionalE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremium\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\Licenses\eval\HomePremiumE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\Licenses\eval\ProfessionalN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasic\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\Licenses\OEM\ProfessionalE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\OEM\StarterE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\eval\EnterpriseE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\_Default\ProfessionalE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\EnterpriseN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\_Default\UltimateE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\Licenses\eval\Professional\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\eval\StarterE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\Licenses\eval\ProfessionalE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomePremiumE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\it-IT\Licenses\eval\Enterprise\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\Licenses\eval\HomeBasic\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\Licenses\OEM\ProfessionalN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\eval\HomePremium\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\eval\StarterN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\Licenses\_Default\ProfessionalE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\OEM\EnterpriseN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\it-IT\Licenses\_Default\UltimateE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\Licenses\OEM\EnterpriseN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\UltimateE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\lpeula.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\Licenses\_Default\Ultimate\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasicE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\OEM\Ultimate\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\Licenses\eval\UltimateN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\Licenses\_Default\UltimateN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\WCN\de-DE\Add_a_device_or_computer_to_a_network_usb.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\lpeula.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\Licenses\eval\EnterpriseN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\Licenses\eval\Enterprise\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasicN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasicN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\Licenses\_Default\Professional\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\eval\UltimateN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\_Default\ProfessionalE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasicN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremiumN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\lpeula.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasic\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremiumE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\eval\UltimateE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\WCN\ja-JP\Add_a_device_or_computer_to_a_network_usb.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\_Default\HomePremium\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\Licenses\OEM\UltimateE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\Licenses\OEM\StarterE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\Licenses\_Default\HomeBasicE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\de-DE\Licenses\eval\UltimateE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\eval\EnterpriseN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\Licenses\eval\Professional\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasicN\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\Licenses\eval\ProfessionalE\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\SysWOW64\es-ES\Licenses\_Default\HomePremium\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\pic.bmp" 87a4f3f9f6dc263378f2f01db5f2c988.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIcon.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384888.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02053J.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginDialogBackground.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Off.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\BUTTON.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\COMBOBOX.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099150.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0175361.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309567.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03425I.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Public_Primary_CA.cer 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierCloseButton.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImages.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145904.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\BREAK.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0390072.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01046J.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341742.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382836.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DATETIME.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\StaticText.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0179963.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormToolImages.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315580.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\NUMERIC.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309705.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341447.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02829J.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03380I.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145212.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382938.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386485.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\RADIO.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\ResourceInternal.zip 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VS_ComponentSigningIntermediate.cer 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145669.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLow.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImages.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DATE.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382948.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384885.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Settings.zip 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\ResourceInternal.zip 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386267.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01221K.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02759J.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\Management.cer 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImage.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Class.zip 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309664.JPG 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files\SelectSync.xlsm 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImage.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-h..homegroup.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f674612e35113616\OOBE_HELP_What_is_HomeGroup.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b20ebe05969f5227\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1cd8423c61339c71\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1043\eula.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\DMR_120.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_253e8c58002c48e1\Tulip.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_it-it_85a0fa7c3f10c98a\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7600.16385_de-de_dab8991dcf40c3bd\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_1f13ba22df0a61ce\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be\Chrysanthemum.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-w..ar-wizard.resources_31bf3856ad364e35_6.1.7600.16385_de-de_970a7644dc297d48\Add_a_device_or_computer_to_a_network_usb.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_15e4306ea29e7ff3\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e9f79a70efa455da\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-scenes_31bf3856ad364e35_6.1.7600.16385_none_a4393b1a254aeaee\img25.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_de-de_b57cde6a4a1831eb\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_be5cbd3b6b3e4c5c\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\Web\Wallpaper\Landscapes\img9.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-h..atement_r.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_e429287568bba98b\privacy.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ea5de2412487a733\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_en-us_fe8f8ca0a21cfbfe\lipeula.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7601.17514_es-es_ed8c9bcde614601c\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_en-us_247c7f7ff2fcb4c5\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\Web\Wallpaper\Scenes\img29.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_it-it_0a63b1ebc6aa1bcd\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-za-component_31bf3856ad364e35_6.1.7601.17514_none_a5926b147a413e6a\ZA-wp1.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_it-it_ba9377df7c776240\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-characters_31bf3856ad364e35_6.1.7600.16385_none_bde0eaed84920a21\img23.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-w..ar-wizard.resources_31bf3856ad364e35_6.1.7600.16385_it-it_cca6156795327692\Add_a_device_or_computer_to_a_network_usb.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_it-it_068a8aa70d654920\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_de-de_1f6d0e034bc137ca\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e73ca319a82aa327\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..essionale.resources_31bf3856ad364e35_6.1.7601.17514_es-es_75e8ec7939c0089d\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_91573a6acf66313b\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-h..atement_r.resources_31bf3856ad364e35_6.1.7601.17514_en-us_b558e03eab75aa2b\privacy.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_es-es_fe5ae984a243eda3\lpeula.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_e3b259cc3b13b0cb\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_en-us_8618b2759ddf665b\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\Web\Wallpaper\Scenes\img30.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_es-es_5a7985085aa15ed9\lipeula.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_de-de_1f1c1bdbc5efe9fd\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7601.17514_it-it_7a6c0813b0185bfc\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1032\eula.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_it-it_7cee3b15ebef4ff3\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1041\eula.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-landscapes_31bf3856ad364e35_6.1.7600.16385_none_e57abb2f66db71a9\img10.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_17db1b7ac306db2a\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f149f1f62cfc0fd8\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1eef89e6f9091c8b\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4827f5a0b6c3696b\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_es-es_b4ad6e797df4a310\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\HandPrints.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-landscapes_31bf3856ad364e35_6.1.7600.16385_none_e57abb2f66db71a9\img11.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img14.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\ShadesOfBlue.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_it-it_62a9262ac5c2ba56\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7600.16385_it-it_37669c3d6397c19d\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_en-us_c85de3fc3a9f438f\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp6.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_de-de_0410dad38ea2e84c\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e9c2f754efcb477f\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-l..terprisen.resources_31bf3856ad364e35_6.1.7601.17514_it-it_a77516706ab8de8c\license.rtf 87a4f3f9f6dc263378f2f01db5f2c988.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87a4f3f9f6dc263378f2f01db5f2c988.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop 87a4f3f9f6dc263378f2f01db5f2c988.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\ 87a4f3f9f6dc263378f2f01db5f2c988.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\TileWallpaper = "0" 87a4f3f9f6dc263378f2f01db5f2c988.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2420 wrote to memory of 1512 2420 87a4f3f9f6dc263378f2f01db5f2c988.exe 32 PID 2420 wrote to memory of 1512 2420 87a4f3f9f6dc263378f2f01db5f2c988.exe 32 PID 2420 wrote to memory of 1512 2420 87a4f3f9f6dc263378f2f01db5f2c988.exe 32 PID 2420 wrote to memory of 1512 2420 87a4f3f9f6dc263378f2f01db5f2c988.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\87a4f3f9f6dc263378f2f01db5f2c988.exe"C:\Users\Admin\AppData\Local\Temp\87a4f3f9f6dc263378f2f01db5f2c988.exe"1⤵
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\cleen.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\[email protected]
Filesize3KB
MD58f340d61075544f961ba2a39a4a61e0f
SHA18ffa69c03333000e2e80c2aa903ad9a865929ba4
SHA25685f711aef5260da894d03cc76914cad6655b89763d6dbaa35bdb5643dda9f641
SHA5123abc799892bd829c66b816e7461282685b2c76f3f6b3acedae21b44338380f0fca4fd8bc1ac063c4943b425666522b3096fe6f3b5b1d05be968640b145fd601c
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
Filesize8KB
MD56e714f5424cfa25d30d2212d517fd138
SHA1a7903bb651f6a349186f2671d9f70b028e3642a8
SHA2564c1bb60246faa30b06cd7da031518457c5585eb67ad92666511cda25da1fe5ec
SHA512d48019b33f319cee62777c979545cd6c53d5a1dac8324caee1cbe31504c0a445acb8b52592716997c1fd6a4e2723537babb26c63bc1090a9974d11c2902e7e11
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
Filesize3KB
MD5e2dd35042f59b1c4ac9d59e821e4f79a
SHA1f2069f97c9187eadbec1bbc4a44828f0e0882735
SHA256beffce82c52915df246c5f81931363ac8451198aa799377465efa54122a29b49
SHA512727b2586118cc76deb894c6198fccda2b5b55af114ad68dce145a330421bc48f744e65d2f8b5c9a1ba6524cf5d8f2e54037486724257b10e85dc421c81eaf628
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
Filesize6KB
MD569337b0278b1533107f81a2aa04a5683
SHA16e710dc94f1bcc03559eba52f19672b60ae38f63
SHA25697fd01e184205cdf0da5ab6fbfeaae3ce5ebe9c25f3e0a7dd6f235737a9bd536
SHA51210a836910e932da754ff178974910bf11d4db54a9b788ac9ba9fdded117e8926a8983a580bd6970a2b89b39bdf1c222f0c916d329fbeced0ba7d0798a435bfa5
-
Filesize
227B
MD5d6497ec019a727eed918c1f2f0a650c3
SHA10f522422b6f1ca9cb5dec89c63676bbca7a1e5bf
SHA2563685684522f7015bba342f0f2e3f7d77de99ebe1c0d8abbda4f31c8ccced3a63
SHA5128a974bc95f3d6f516ef69c3d0768f0298290709ceac6bc1ded24c7b88c555d6ef728ba6a0dafc06c257e54d3ea1a2bf901c6308d25d87f1503d56ba812a483a0
-
Filesize
14KB
MD5b90cc7975a271604bd5081cbf810c014
SHA1eced4946605d107166df9c5a70465f6482dbde5d
SHA25600f950270f18d866c1a94112cfa5b339e45dabaa1fb8fb8e039386b3bf9570ef
SHA512a897a68a573ace344f7824108f8b2d50bea0e23f5737984b85db7366d95a17d1f532231d1a8ab1d7b9bff15905f7473063b2791a443025c5bf4916aa9d3678b8
-
Filesize
26KB
MD57ae3f5e273d032e129573fd35ab18617
SHA1f0448dbd8476d909386b3b7b6b03395d86c4f1db
SHA25630b094f371e6e1838e62100ccc6a2c522eb174a4d245ad43607e2c497c7f711a
SHA512e81462c02760a8ef31a87267df4f028a059eb40606d9fe228decfab0697da1bbf72527d91331c5d2b42c963fb549e1945896bbb19868c9b75e11c40efd5671e7
-
Filesize
9KB
MD56a5cd90fbf5427110743d4a7e1a940a9
SHA1ae3dfcc93782111784ba9b75bebdf9ed0e44ac05
SHA2569cfd5e2b57446ce514648304dafb571304dbb4a2de421b0ca20b6f28b677e6f5
SHA51250789e7e075c464b9b875bb6f8f28faef367e63ad4989bd34481d45bbe62e1ef74a3cebff52fe8065bd04a8e34d60ff4b020a06ea51afe648a1a295613e30734
-
Filesize
1KB
MD5809f2e22aa6bd8d23044a96fe1ca0183
SHA1f5963dbe5a820390661511e7a7a914c637094977
SHA2560b86b7a576c3a86a073321895915b98713d83f0c637a53d254109b27883bc995
SHA5129e46c0a6d6a5fdb40dac96f508fb419ebf5f528c53e9c0acea1674bf3da7f268c8c1d7cc956b6d11bba308978c46fce79fbe114d0dbb12ec34e94448822b212d
-
Filesize
10KB
MD5b7c4eaea9d8de103303bd2d5a5eb4e9d
SHA1f61ea5cb72d86838a80cbad7d018f128f6f4c892
SHA256c33557e20b798c6f987da2d1dbfca4df523d4dbc0d90b358ac51a063a86fc07f
SHA5125a215ed8f157d17e319be7a9b6ef44ae94dfb4da0a7e70820b207196f5214545353cec3a614934f5ec87b92e3f822c91f785bc7820f87c9611051e725c465da2
