Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-01-2025 01:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe
Resource
win7-20241010-en
windows7-x64
18 signatures
150 seconds
General
-
Target
7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe
-
Size
772KB
-
MD5
68029b2bf01d687a4661d4b61a2f0740
-
SHA1
b9431ba2ae320295935f70a68764c387a9450411
-
SHA256
7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6
-
SHA512
1c7f5ab2bad06d24f2b49a8c6b34f60954aabd9abfc2d879c6b1eda7614c4f044bbb6262f015f2ed421e4966b06bf9c693ca854ba17146e7c33830984ea689c0
-
SSDEEP
24576:mVzwix9dfixVZ1L61ePrXxW4T0tfEEL0uX:eDNfixU12TxcxEEY
Malware Config
Signatures
-
Expiro family
-
Expiro payload 1 IoCs
resource yara_rule behavioral2/memory/1036-4-0x0000000000400000-0x0000000000688000-memory.dmp family_expiro1 -
Executes dropped EXE 6 IoCs
pid Process 1852 elevation_service.exe 2852 elevation_service.exe 1620 maintenanceservice.exe 1140 OSE.EXE 4080 ssh-agent.exe 4400 TrustedInstaller.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdgkfajodaliacghnafobjnclblcfmlm\1.0_0\manifest.json 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\M: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\O: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\R: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\V: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\Z: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\K: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\Q: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\T: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\U: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\X: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\Y: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\G: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\I: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\J: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\P: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\W: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\E: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\H: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\N: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened (read-only) \??\S: 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe -
Drops file in System32 directory 61 IoCs
description ioc Process File opened for modification \??\c:\windows\system32\msdtc.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created \??\c:\windows\system32\ndgfpknh.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\tieringengineservice.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\Agentservice.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\searchindexer.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\msiexec.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\lsass.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\sgrmbroker.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\openssh\ssh-agent.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\tieringengineservice.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\Agentservice.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\locator.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\sgrmbroker.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created \??\c:\windows\system32\cikeeloi.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created \??\c:\windows\system32\WindowsPowerShell\v1.0\bknnbpcd.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\fxssvc.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\perfhost.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\sensordataservice.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created \??\c:\windows\system32\dgpgqhaj.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\wbengine.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\dllhost.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\snmptrap.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created \??\c:\windows\system32\qmecqnod.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created \??\c:\windows\system32\openssh\abilpbfb.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created \??\c:\windows\system32\bcjjbfaa.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created \??\c:\windows\SysWOW64\bohlocej.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\spectrum.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\svchost.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\alg.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\vds.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created \??\c:\windows\system32\ochhoqke.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\vssvc.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\Appvclient.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created \??\c:\windows\system32\hhdmmjfb.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\sensordataservice.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\addfgiiq.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\spectrum.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\Appvclient.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\system32\openssh\ssh-agent.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\program files\common files\microsoft shared\source engine\ose.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\bin\fhkccgam.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\bmmoojdm.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jre-1.8\bin\eajefjjm.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Internet Explorer\aglddoil.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\bin\ogogbdbj.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jre-1.8\bin\aplfnjfi.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\dklkkafp.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\eehkqlfa.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\bin\feqkbkgm.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\aqlckbbn.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created \??\c:\program files\windows media player\llkojhcd.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\bhlnifll.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\bin\hpbanfjo.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\bin\fhmdllan.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\eqiodbdg.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\bin\kefbfhkg.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\bin\ofbhkgdg.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jre-1.8\bin\cejhemnb.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\knjpmnmh.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\oocjcpii.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\7-Zip\afaqkaok.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\emdpmifb.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\bin\jeoonppk.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\bin\finbkiei.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\hjbnmekf.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jdk-1.8\bin\ookbgdam.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jre-1.8\bin\fcmpdicp.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jre-1.8\bin\giiiomdg.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jre-1.8\bin\nikalpei.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created \??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\mngoiagq.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\7-Zip\ncjookla.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Java\jre-1.8\bin\kjlepkii.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File created C:\Program Files\Internet Explorer\qfemblig.tmp 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logs\CBS\CBS.log TrustedInstaller.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TrustedInstaller.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1036 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1036 7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe"C:\Users\Admin\AppData\Local\Temp\7c9966301ef6631298ddcc0d8ef36d7df2464cdaa9217b6ec1ec686c740b37f6.exe"1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1036
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1852
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2852
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1620
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1140
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4080
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4400
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD58fc3f6329ab848c459efbf8ff3a3d29c
SHA12182189f28ce85a4bf9ba93a2585e6df10a4c42c
SHA25661295b7c6251d5aec8631fc78f6935b8ce678dd0c500f6353cbdfb4544cb6fcb
SHA51250e886aec800c74ffb71575737e879bb889fc1a2dbe6c10ebd9ebbbc09cda32a41c99726ada138b3694bafafd12742376cb8e5143cf1070b98b761d43f77c077
-
Filesize
805KB
MD55639c093007affb46421a5e526d0dc2d
SHA1a3b12ff891e9a488343c3b57f91f629534fb2409
SHA2565a718f88a9579cbd7a501d4da759657d682be9abe5fc6b794d79cf98ff1c6c94
SHA512e1abd037f3aa01791a7e58e39e7c421806e207e29321c9bb7c8806fca9f890ec643923d69b1b898e0702941c897a7aa9f85fcf96afb2054150b0804dc6553893
-
Filesize
821KB
MD5152854f39de569c19dd49438f81a9993
SHA1b60c97a2c1338f49fdce9c11caa43ecd3108f317
SHA256ee5196e7115dcb8fe047868a314bff584b65dbb44af30f8e1ee89d2377952ec0
SHA512fe0ab2997d822cea464ef70e8a4a4c24ff80d5f6806a0f9012f9d1bd525055511f815982390ce17deaa293851e06034230c57f9c50b82895608c24d664867d9d
-
Filesize
4.6MB
MD5704d775255ff02e52524c97e8789f527
SHA18fd441a4093cf86787b09aa942742939cb9f10c1
SHA256a0c9848ff3a4184065a716cf221dcee81154492e5be0bddb419510244b1886ed
SHA5121b64e41ac812b793ccffe188c6283998a9ff131c49386d557a699a43efa2a25dbfaeada773e49da76a4ccb18e8d915578e65568f71e370137b95c2bf0f45effe
-
Filesize
2.2MB
MD559c67321213171345a1fc492080e9761
SHA1cd652fc23500a946e3facc8f092116d6e32e9806
SHA256b775c361f59af8021b73f025de27e1a1115f125d2842e9cd135944febaf2f07e
SHA51273aedbce711ab7b20ceeb0b98a0c37aa07869c55228413b8ef5530e8ff681e1ea4de231ccbea45254033f40fb66ff6869d52878ddb3522a8580edc101aeb8516
-
Filesize
1.4MB
MD58310aa484028bbd4a072c8b32fbee011
SHA1ff6a70ddee82b510101c7b45faff8b937170110f
SHA256646b1980e1f7910e428ba700ce3f252e919aeaccce055627d6bfad088a008ddf
SHA512c21a8e0f3ef980687077b107285bc0200f1deb08847862ad9e2e2f584b4b2f76a749110eddc24588ba4a7b3ccbe4ac04fe7d8afdb24fa01c2e8e9f75968dc8fb
-
Filesize
1002KB
MD50743bd0831c81898e8b1fad436b89e50
SHA1a1da77aac13a96624e15300120b37c0497b72247
SHA2565b035201ba2b9776a738004affd972cede368af4a053a97f80394997880e8ce6
SHA5126d50ad1bf0546b9891ced258189214d3e83505a876589a9d523a7a9a43e88a3253e5e8dbcf54ec1b87563c4cfc531e2ac26d8d8198124dcfde51f8e8355a7df5
-
Filesize
956KB
MD59d390e390313f8e8da138655d2cca314
SHA14d367e60673466564224def86df1479b01a27e6e
SHA256dcf289ae8b5213b9b2a4c7ce95cfaf6554fe96d5d73e12bef1269f81ab6bfd59
SHA512f9e556f1262e8489b85769e724ebf3791544d9afe67b35229f4894a9c3289a0715e7e016d9650b1725452f23ac2c3f348e10292f0884558b6b238f4f9e0acc49
-
Filesize
193KB
MD5805418acd5280e97074bdadca4d95195
SHA1a69e4f03d775a7a0cc5ed2d5569cbfbb4d31d2d6
SHA25673684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01
SHA512630a255950c0ae0983ae907d20326adea36ce262c7784428a0811b04726849c929bc9cea338a89e77447a6cec30b0889694158327c002566d3cf5be2bb88e4de