Analysis
- max time kernel
95s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
19/01/2025, 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
General
- Target 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe
- Size 92KB
- Sample250119-xt4dssskcp
- SHA256 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530
- MD5 a9f6b8b6a8bb7225884ae4acad9ede21
- SHA1 163ab5211709981d4872382a1fa6179fe9950038
- SHA512 c0df9ed57d272616e438e1d48fa09bf1a9b315687a38476d05a34b342a3c99fbeb392c50287a041f70f65ec60378b68de073f92aa713651e71f1153a823c2e6c
- SSDEEP 1536:DHB0UxMkzOt7HcvJGt5AdHIOWnToIf12ZqTUgawozmoJ:DhAWJGSCTBf12Z1gtozm+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\MSDT.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\SCHTASKS.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHFILTERHOST.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\RASERVER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\XCOPY.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\CHOICE.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\CURL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\RELOG.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\RPCPING.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMUWPLAUNCHER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\EVENTVWR.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\INPUTSWITCHTOASTHANDLER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\LOGAGENT.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\NET.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\ODBCCONF.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\PRINT.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERPT.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\DWWIN.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\ESENTUTL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\TASKMGR.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\DOSKEY.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\POQEXEC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\PSR.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPERFORMANCE.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\W32TM.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\CHECKNETISOLATION.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\FONTDRVHOST.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\RASDIAL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\WHOAMI.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\XWIZARD.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\DPAPIMIG.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\WWAHOST.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\WIAACMGR.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\DCOMCNFG.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\EUDCEDIT.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\MAKECAB.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\RUNAS.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\SC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\SHUTDOWN.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\DPISCALING.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\MSINFO32.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\PCAUI.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\SECEDIT.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERT.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\NEWDEV.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\REGINI.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\CAMERASETTINGSUIHOST.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\CHKNTFS.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\DIALER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\DISKPART.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\GPUPDATE.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\NET1.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\WRITE.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\CMD.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\COMP.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\NETPLWIZ.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\SETX.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\TPMTOOL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\FIXMAPI.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\SETHC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPROTECTION.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SysWOW64\TYPEPERF.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\JAVA\JAVA UPDATE\JAUREG.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\IDENTITY_HELPER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVAWS.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\ORBD.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\CLIENT\APPVLP.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PPTICO.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\PPTICO.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-0C0A-1000-0000000FF1CE}\MISC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.DESKTOPAPPINSTALLER_1.0.30251.0_X64__8WEKYB3D8BBWE\APPINSTALLERELEVATEDAPPSERVICECLIENT.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\APPLETVIEWER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KTAB.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\SMART TAG\SMARTTAGINSTALL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX86\MICROSOFT SHARED\EQUATION\EQNEDT32.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OHUB32.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWS.PHOTOS_2019.19071.12548.0_X64__8WEKYB3D8BBWE\MICROSOFT.PHOTOS.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSMAPS_5.1906.1972.0_X64__8WEKYB3D8BBWE\MAPS.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WABMIG.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS NT\ACCESSORIES\WORDPAD.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.147.37\MICROSOFTEDGEUPDATEBROKER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICE16\LICLUA.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVA.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\FILECOMPARE.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WABMIG.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.GETHELP_10.1706.13331.0_X64__8WEKYB3D8BBWE\GETHELP.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\PJ11ICON.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION_4.4.8204.0_X64__8WEKYB3D8BBWE\SOLITAIRE.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\DOTNET\DOTNET.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IELOWUTIL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JCMD.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\NATIVE2ASCII.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MISC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVCLEANER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\RMIREGISTRY.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SDXHELPER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\COMMON.DBCONNECTION64.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPRPH.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\6.0.27\CREATEDUMP.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSADEBUGD.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\SERIALVER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\RMID.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PDFREFLOW.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\SCHEMAGEN.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\XJC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\OFFICEAPPGUARDWIN32.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOX.TCUI_1.23.28002.0_X64__8WEKYB3D8BBWE\TCUI-APP.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.371\GOOGLECRASHHANDLER64.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\NOTIFICATION_HELPER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\IDLJ.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAR.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\UNPACK200.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\VISICON.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-0409-1000-0000000FF1CE}\MISC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.OFFICE.ONENOTE_16001.12026.20112.0_X64__8WEKYB3D8BBWE\ONENOTESHARE.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WEBPIMAGEEXTENSION_1.0.22753.0_X64__8WEKYB3D8BBWE\CODECPACKS.WEBP.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSSOUNDRECORDER_10.1906.1972.0_X64__8WEKYB3D8BBWE\SOUNDREC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.NETFX45.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\OLICENSEHEARTBEAT.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGIN-CONTAINER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UPDATER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.549981C3F5F10_1.1911.21713.0_X64__8WEKYB3D8BBWE\CORTANA.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\ARM\1.0\ADOBEARMHELPER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.371\GOOGLEUPDATEBROKER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.CAPTUREPICKER_CW5N1H2TXYEWY\CAPTUREPICKER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SMSVCHOST\V4.0_4.0.0.0__B03F5F7F11D50A3A\SMSVCHOST.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\VBC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_STATE.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\MSBUILD.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFTWINDOWS.UNDOCKEDDEVKIT_CW5N1H2TXYEWY\UNDOCKEDDEVKIT.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADDINPROCESS_B77A5C561934E089_4.0.15805.0_NONE_74BABA51266F3010\ADDINPROCESS.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\LOGTRANSPORT2.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\CSC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\WFSERVICESREG.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_COMPILER_B03F5F7F11D50A3A_4.0.15805.0_NONE_73CC8B3E43BA1056\ASPNET_COMPILER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ACROTEXTEXTRACTOR.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CASPOL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\REGSVCS.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\WINDOWS.CBSPREVIEW_CW5N1H2TXYEWY\CAMERABARCODESCANNERPREVIEW.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_COMPILER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSBUILD.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\COMSVCCONFIG.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\NOTEPAD.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_DATASVCUTIL_B77A5C561934E089_4.0.15805.0_NONE_5B1ADA239E3B0505\DATASVCUTIL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGIIS.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_REGSQL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CVTRES.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VBC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\APPLAUNCH.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\INSTALLUTIL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGENTASK.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.PEOPLEEXPERIENCEHOST_CW5N1H2TXYEWY\PEOPLEEXPERIENCEHOST.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\ADDINPROCESS32.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DFSVC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADOBE-FLASH-FOR-WINDOWS_31BF3856AD364E35_10.0.19041.82_NONE_2358A116979CC599\FLASHUTIL_ACTIVEX.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\IEEXEC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\INSTALLUTIL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SPLWOW64.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.SECUREASSESSMENTBROWSER_CW5N1H2TXYEWY\SECUREASSESSMENTBROWSER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSBUILD.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\WINHLP32.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\WSATCONFIG\3.0.0.0__B03F5F7F11D50A3A\WSATCONFIG.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\LDR64.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_REGSQL_B03F5F7F11D50A3A_10.0.19041.1_NONE_C9157DDC38B83B1B\ASPNET_REGSQL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\CSC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INPUTAPP\TEXTINPUTHOST.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DFSVC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\REGASM.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\APPLAUNCH.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\WSATCONFIG.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_COMPILER_B03F5F7F11D50A3A_10.0.19041.1_NONE_9202844CD514AB44\ASPNET_COMPILER.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_32\MSBUILD\3.5.0.0__B03F5F7F11D50A3A\MSBUILD.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\DATASVCUTIL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\NGEN.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\SMSVCHOST.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\VBC.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.OOBENETWORKCONNECTIONFLOW_CW5N1H2TXYEWY\OOBENETWORKCONNECTIONFLOW.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_REGIIS.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SPEECH\COMMON\SAPISVR.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.ACCOUNTSCONTROL_CW5N1H2TXYEWY\ACCOUNTSCONTROLHOST.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ILASM.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\DW20.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WPF\PRESENTATIONFONTCACHE.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\DATASVCUTIL.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ACRORD32.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGBROWSERS.EXE 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe"C:\Users\Admin\AppData\Local\Temp\5095c48550af05e9fb4c79a6c89031426e160497c8aafa72cdd8795d542e3530.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:696