Overview
overview
10Static
static
10757e3242f6...b4.exe
windows7-x64
9757e3242f6...b4.exe
windows10-2004-x64
976fe72e0ec...ss.exe
windows7-x64
776fe72e0ec...ss.exe
windows10-2004-x64
1078d4cf8df6...B3.exe
windows7-x64
778d4cf8df6...B3.exe
windows10-2004-x64
1078d4cf8df6...59.exe
windows7-x64
778d4cf8df6...59.exe
windows10-2004-x64
378db508226...69.exe
windows7-x64
978db508226...69.exe
windows10-2004-x64
97965f6adf3...ss.exe
windows7-x64
77965f6adf3...ss.exe
windows10-2004-x64
77B75B33BCF...B5.exe
windows7-x64
17B75B33BCF...B5.exe
windows10-2004-x64
17E3903944E...72.exe
windows7-x64
77E3903944E...72.exe
windows10-2004-x64
57dd9312307...ca.dll
windows7-x64
37dd9312307...ca.dll
windows10-2004-x64
37e4c9a7e39...1f.exe
windows7-x64
97e4c9a7e39...1f.exe
windows10-2004-x64
780eb72d781...B3.exe
windows7-x64
780eb72d781...B3.exe
windows10-2004-x64
1080eb72d781...9A.exe
windows7-x64
780eb72d781...9A.exe
windows10-2004-x64
3845263c869...c8.exe
windows7-x64
9845263c869...c8.exe
windows10-2004-x64
98524224187...8f.exe
windows7-x64
68524224187...8f.exe
windows10-2004-x64
686be3831f5...39.exe
windows7-x64
686be3831f5...39.exe
windows10-2004-x64
68791931bac...DA.exe
windows7-x64
78791931bac...DA.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 09:21
Behavioral task
behavioral1
Sample
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral10
Sample
78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral11
Sample
7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
7B75B33BCF4ECF013B93F84ED98B3FB5.exe
Resource
win7-20240729-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
7B75B33BCF4ECF013B93F84ED98B3FB5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
7E3903944EAB7B61B495572BAA60FB72.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
7E3903944EAB7B61B495572BAA60FB72.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe
Resource
win7-20241010-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral20
Sample
7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral21
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral23
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral26
Sample
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral27
Sample
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral28
Sample
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral29
Sample
86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral32
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
-
Size
18KB
-
MD5
d8e99fcae9a469c2081e7ff01675c361
-
SHA1
ef7c4358717ec9d04b9adc8e40b1eb928885ebf0
-
SHA256
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4
-
SHA512
cd75242646dde33b7c792e9bf9fe976ce7f2dd1b02c5c97a4cf2f9f80cfae1bd44463fc2b0f9e002d17087358fafa298ca0d4dc4aff17405df95f13099c79b02
-
SSDEEP
384:rd7gYWDhghSmeSQjkCg3St1bVz1LTwbZxssimS8dHDT:6lg/eLjkCwQQFx8SHX
Score
9/10
Malware Config
Signatures
-
Renames multiple (1655) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 2 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc Process File created C:\Windows\System32\drivers\gmreadme.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Drops startup file 2 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DjrsqvgahLYXnru.exe 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DjrsqvgahLYXnru.exe 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc Process File created C:\Windows\System32\HandwritingSystemToastIcon.contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\OkDone_80.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\oobe\fr-FR\OOBE_HELP_Opt_in_Details.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\PerceptionSimulation\Assets\Pinch.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\Speech_OneCore\common\toast-hero-image.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\@AppHelpToast.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\BluetoothPairingSystemToastIcon.contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\BluetoothPairingSystemToastIcon.contrast-high.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\default.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\default.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\oobe\ja-JP\OOBE_HELP_Opt_in_Details.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\SecurityAndMaintenance_Error.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\ActiveHours.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\oobe\FirstLogonAnim.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\oobe\fr-FR\oobe_learn_more_activity_history.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\default.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\MSDRM\MsoIrmProtector.doc 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\PerceptionSimulation\Assets\OpenHand.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\Speech_OneCore\common\privacy-icon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\restore\MachineGuid.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\@AdvancedKeySettingsNotification.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\SpeakersSystemToastIcon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\X_80.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\default.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\en-US\default.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\OkDone_80.contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\wpcatltoast.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\oobe\de-DE\oobe_learn_more_activity_history.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\InputSystemToastIcon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\default.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\default.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsCodecsRaw.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsCodecsRaw.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\RestartTonight_80_contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\SvBannerBackground.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\oobe\en-US\oobe_learn_more_activity_history.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\@VpnToastIcon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\KeyboardSystemToastIcon.contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\RestartNowPower_80.contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\@language_notification_icon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\MouseSystemToastIcon.contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\Snooze_80.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\oobe\es-ES\oobe_learn_more_activity_history.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\@WirelessDisplayToast.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\@edptoastimage.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\ComputerToastIcon.contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\HandwritingSystemToastIcon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\RestartTonight_80_contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\SecurityAndMaintenance.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\MailContactsCalendarSync\LiveDomainList.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\HeadphoneSystemToastIcon.contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\InputSystemToastIcon.contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\RestartTonight_80.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\MediaSystemToastIcon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\X_80.contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\MailContactsCalendarSync\LiveDomainList.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\@AudioToastIcon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\@WirelessDisplayToast.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\Bthprops\@BthpropsNotificationLogo.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Drops file in Program Files directory 64 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc Process File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleMedTile.scale-125.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\3039_24x24x32.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-36.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-96.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_altform-unplated_contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-unplated_contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-200.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-64_altform-unplated_contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-96_altform-unplated.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Close.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\x_2x.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-100.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalMedTile.scale-100_contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalSplashScreen.scale-125_contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80_altform-lightunplated.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-200.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-200.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\offer_cards\credit-illustration.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-125.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-100.HCBlack.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-64.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-125.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Google.scale-100.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-48.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-125_contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-20_altform-lightunplated.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\action_poster.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WideTile.scale-100.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Snooze.scale-80.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_altform-unplated.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-96_contrast-high.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail-Dark.scale-125.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-96_altform-unplated.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-200.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-white_scale-100.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.contrast-white_scale-125.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-400.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-24_altform-unplated.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_altform-unplated_contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-125_contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileWide.scale-200.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\161.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare.scale-200.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeMediumTile.scale-150.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square44x44Logo.scale-125.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\info.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-125_contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-100.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-60_contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\JumpListSettings.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\RotateHorizontallyOverlay.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionMedTile.scale-100.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-100.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoDev.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Drops file in Windows directory 64 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc Process File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\OfflineTabs\OfflineTabs.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\Splashscreen.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\PeopleLogo.scale-150.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.264_none_a61d15efb6291d40\Answer.scale-300.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_9478227a478f23d5\about_Pester.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SystemResources\Windows.UI.Shell\Images\RequestedDownloadsCloudIcon.contrast-black_scale-150.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_es-es_80b0e69d86443d44\Tracking_Logic.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..llment-winrt-client_31bf3856ad364e35_10.0.19041.264_none_385fcd84cd1a274b\@EnrollmentToastIcon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\defaultbrowser.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..l-wallpaper-windows_31bf3856ad364e35_10.0.19041.1_none_910333b84fcf455a\img0_1366x768.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSplashScreen.scale-125_contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\logo.contrast-black_scale-400.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\pdferrorquitapplicationguard.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\wide310x150logo.scale-125.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square310x310Logo.contrast-white_scale-400.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.targetsize-96_contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Assets\LeftClick.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\hololensWorkAccount.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\deleteAll.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgePDF.targetsize-256.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_10.0.19041.1_none_dbc769c889701b8b\security0.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\retailDemoSecurityInclusive.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\zdingbat.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\splashscreen.contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\403.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\Assets\Logo.Theme-Dark_Scale-100.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\403-18.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\oobe-listview-template.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\RatingStars42.scale-200.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-32_altform-unplated.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobelanguage-main.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\f\oobelocalaccount-main.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare150x150Logo.scale-400_contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobehello-main.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleLogo.targetsize-36_altform-unplated.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\views\tokenManagerErrorHandler.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-24_altform-unplated_contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\wide310x150logo.scale-400.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\ResetDriveSquare44x44Logo.scale-150_contrast-white.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.1_none_8089599dd595a93d\@AdvancedKeySettingsNotification.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\InputApp\Assets\SquareLogo310x310.scale-100.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\SquareTile150x150.scale-400.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_4.0.15805.0_none_f6eda1475d000884\CreateAppSetting.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_systemresource-wind..-ui-accountscontrol_31bf3856ad364e35_10.0.19041.1_none_8805ef3af31f4b8c\Advanced.Theme-Light_Scale-100.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\invalidcert.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSplashScreen.scale-400.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\500-100.asp 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\pdferrorofflineaccessdenied.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.targetsize-72_altform-unplated_contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white_scale-150.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\de\SqlWorkflowInstanceStoreSchema.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.targetsize-30_altform-unplated.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSplashScreen.scale-400_contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_fr-fr_1913b24a44b591ab\DropSqlPersistenceProviderLogic.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars49.scale-200.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\default.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\OfflineTabs.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_webadmin_users_b03f5f7f11d50a3a_4.0.15805.0_none_cd2cf0af757e55d5\editUser.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\Square44x44Logo.targetsize-72.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\sslnavcancel.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.746_none_492c8c53f3547077\Pinch.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.targetsize-32_altform-unplated_contrast-black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exepid Process 3312 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 3312 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 3312 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 3312 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 3312 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 3312 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 3312 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription pid Process Token: SeDebugPrivilege 3312 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe"C:\Users\Admin\AppData\Local\Temp\757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3312