Overview
overview
10Static
static
3tmpanfn5x1c.exe
windows10-2004-x64
8tmpanfn5x1c.exe
windows11-21h2-x64
6ADVPACK.dll
windows10-2004-x64
3ADVPACK.dll
windows11-21h2-x64
3W95INF16.dll
windows10-2004-x64
1W95INF16.dll
windows11-21h2-x64
1W95INF32.dll
windows10-2004-x64
3W95INF32.dll
windows11-21h2-x64
3fngrprnt.dll
windows10-2004-x64
3fngrprnt.dll
windows11-21h2-x64
3msnphoto.scr
windows10-2004-x64
3msnphoto.scr
windows11-21h2-x64
3msvcr71.dll
windows10-2004-x64
3msvcr71.dll
windows11-21h2-x64
3pibase.dll
windows10-2004-x64
3pibase.dll
windows11-21h2-x64
3pidav.dll
windows10-2004-x64
3pidav.dll
windows11-21h2-x64
3piorg.dll
windows10-2004-x64
3piorg.dll
windows11-21h2-x64
3piorgres.dll
windows10-2004-x64
1piorgres.dll
windows11-21h2-x64
1pisync.dll
windows10-2004-x64
3pisync.dll
windows11-21h2-x64
3pisynctw.exe
windows10-2004-x64
3pisynctw.exe
windows11-21h2-x64
3piview.dll
windows10-2004-x64
3piview.dll
windows11-21h2-x64
3slides~1.js
windows10-2004-x64
10slides~1.js
windows11-21h2-x64
10startup.js
windows10-2004-x64
3startup.js
windows11-21h2-x64
3Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/05/2026, 01:40
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
tmpanfn5x1c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpanfn5x1c.exe
Resource
win11-20260513-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
ADVPACK.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
ADVPACK.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
W95INF16.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
W95INF16.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
W95INF32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
W95INF32.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
fngrprnt.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
fngrprnt.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
msnphoto.scr
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
msnphoto.scr
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
msvcr71.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
msvcr71.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
pibase.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
pibase.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
pidav.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
pidav.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
piorg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
piorg.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
piorgres.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
piorgres.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
pisync.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
pisync.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
pisynctw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
pisynctw.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
piview.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
piview.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
slides~1.js
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
slides~1.js
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
startup.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
startup.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
General
- Target tmpanfn5x1c.exe
- Size 2.3MB
- Sample260523-b32exacy41
- SHA256 e5cc4a232bd7bfcc2a57174554c284527bce0e2f494f1e9190c9c4c469985eca
- MD5 a00f59737d82c8df1c974b50e80e03f8
- SHA1 470a71a8d4645e9aa96b36f5b99a609f90faf142
- SHA512 de9ae03b9a20bf262cfe34af0f759ada873eb004a51a9f6d8ae88e325a9a34e4530b68daa699e255f05bb379fdedad6506c4edb6aa264219b3293b96b0163bc7
- SSDEEP 24576:+VYbWzOqXT4XFrhe1v/xRZJQnxBrabsM8KGH7Co0OLeGrIocE5lArjPPW:XWzORX1he1HxRqr08KGbNLeGMb4unW
- TLSH T12DB57C10A3DAF491F67E1F3498B157520E757D268A32C57ABAEC398DF83C2137924722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\de-DE\NDISCAPWindows.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\drivers\mircmIRC.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\drivers\mircmIRC.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\drivers\MicrosoftOperating10.0.19041.1110.160101.0800.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\drivers\MicrosoftOperating10.0.19041.1110.160101.0800.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\drivers\de-DE\NDISCAPWindows.exe tmpanfn5x1c.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\mIRCmirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpanfn5x1c.exe" tmpanfn5x1c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mIRCmirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpanfn5x1c.exe" tmpanfn5x1c.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\MUI\0407\mscoreesMicrosoft.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\fr\resourcesMicrosoft.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\en\WindowsWindows.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\wbem\ja\MicrosoftMicrosoft.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\prnge001.inf_amd64_1daeee8f3aa30fcb\Amd64\SystemTtyres.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\hu-HU\XamlOperating.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\fr\dexploitationdexploitation.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\iai2c.inf_amd64_a77c815b2999404d\iai2cDriver.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\WindowsOperating.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\virtdisk.inf_amd64_9a7f42b85c7def50\bttfltWindows.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\pt-BR\QuickAssistWindows.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\en-US\Microsoftdot3msm.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\uaspstor.inf_amd64_63788a81c4c628c5\UaspMicrosoft.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\MUI\0409\mscoreesWindows.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\es-ES\ExplorerMicrosoft10.0.19041.1.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\wbem\fr-FR\mircmIRC.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\pt-PT\XamlWindows.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\fr-CA\SyncResQuickAssist10.0.19041.1.160101.0800.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\uk-UA\Windowsaudiodev10.0.19041.1.160101.0800.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\MUI\0C0A\mscoreesFramework.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\SpeechDesktopPSSapi.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\sr-Latn-RS\SystemMicrosoft.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_5aa81644af5957b3\Surfacemsux64w10.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\sk-SK\SystemWindows5.82.160101.0800.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendOneNote.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\WindowsSystem.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\IME\IMEKR\WindowsmIRC.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\applets\mircimtcdic.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\DriverFamily24016.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\Intelnetwew00.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\nb-NO\COMCTL32SyncRes6.6.19041.1.160101.0800.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\migration\de-DE\OperatingWindows.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\RCX5460.tmp tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\de\resourcesresources.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\MUI\040C\mscoreesFramework650.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\bthleenum.inf_amd64_11f9ff6c12dbf9b5\LegacyLEEnumerator.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\hidtelephonydriver.inf_amd64_43fa6b1db642df7e\WindowsOperating.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\usbcciddriver.inf_amd64_400a61104320a399\SystemWindows.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\intelta.inf_amd64_ba962d801a22973c\inteltaSystem10.0.19041.546.160101.0800.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\F12\F12AppInternet.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\migration\de-DE\OperatingWindows.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\PSEventsdefaulthelp.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\wbem\ja\MicrosoftmIRC.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\F12\F12AppInternet.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\pl-PL\MicrosoftAPHostRes.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\itsas35i.inf_amd64_4f5850c71046b0cb\driverdriver.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\ja\Systemresources10.0.19041.1.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\pl-PL\mIRCmirc.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\IME\IMETC\applets\imtcdicimtcskf.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\SystemOperating10.0.19041.1.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\wirelessNetwork.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\IME\IMEKR\DICTS\Systemimkrhjd.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\applets\imtcdicimtcskf.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\megasas35i.inf_amd64_4df7f6223ebcd28d\megasas35iDriver.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\sisraid4.inf_amd64_65ab84e9830f6f4b\SiSRaid4Microsoft3.60.03.0709261510.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\Speech\Common\de-DE\sapiWindows.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\btampm.inf_amd64_445ffdc4132cbc59\btampmbtampm10.0.19041.1.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\wvpci.inf_amd64_86afbe8940682d27\vpciOperating.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\he-IL\SystemWindows.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\mIRCmIRC.exe tmpanfn5x1c.exe File created C:\Windows\System32\DriverStore\FileRepository\stexstor.inf_amd64_fefc1160d15aa667\stexstorSuperTrak31772.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\de-DE\SapiMicrosoft.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\pspluginwkrWindows.exe tmpanfn5x1c.exe File created C:\Windows\SysWOW64\MUI\0409\mscoreesWindows.exe tmpanfn5x1c.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\operativoWMPMediaSharing.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\EBWebView\x86\EmbeddedMicrosoft.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Windows NT\TableTextService\OperatingWindows.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\WMPNSSCIWMPMediaSharing12.0.19041.1.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\SystemOperating10.0.19041.1.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\PackageManagementOperating.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ietoedgestubexeIEToEdge139.0.3405.125.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\Microsoftvstoee.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstallerVisual.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\ClientInstrumentation.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\FrameworkEntity.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\System\ado\fr-FR\Microsoftmsader15.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\InstallerEdge.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\UpdaterUpdater.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ietoedgebhoietoedgebho64.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\MicrosoftOperating.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AcrobatAdobe.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\ja-JP\Windowsmsader15.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\DecryptionContent.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\msdaorarWindows.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\MicrosoftSystem.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libEGLDirectX.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\libGLESv2onedsdll1.14.146.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\EBWebView\x86\WebViewEmbeddedBrowserWebView.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\EBWebView\x64\EmbeddedWebView.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\AcrobatQuickTime.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\InternetInternet.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Google\Update\Updaterupdater.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\AcrobatNPPDF32.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\CustomSwiftShader132.0.2957.140.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\libGLESv2onedsdll1.14.146.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgepwalauncherdualengineadapter139.0.3405.125.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Windows Defender\fr-FR\MicrosoftWindows.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\WindowsTipTsf.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows Multimedia Platform\Windowssqmapi.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\en-US\SystemWindows.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\System\msadc\msdaprsrmsadco.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprphSystem.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Windows Defender\fr-FR\MicrosoftWindows.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\pluginLink19.10.20064.310990.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Windows Multimedia Platform\Windowssqmapi.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\System\msadc\en-US\msadcormsadcor.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\AppInfoDocumentTools.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\System\it-IT\Microsoftoperativo.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\System\it-IT\Microsoftoperativo.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setupexeInstaller.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\MicrosoftDAO360.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ietoedgebho64dllIEToEdge.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\AdobeAdobe.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\mshwLatinSystme.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgepwalauncherdualengineadapter139.0.3405.125.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\MicrosoftVisual.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\WindowsSistema10.0.19041.1.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\System\ja-JP\SystemMicrosoft.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\WindowsTabTip3210.0.19041.1.160101.0800.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\sqlxmlxoledb32r.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\sqloledboledb32r.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\msdaorarWindows.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\OfficeVisual10.0.60828.0.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdge1.3.147.37.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\WindowsWindows.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\EBWebView\x64\EmbeddedMicrosoft.exe tmpanfn5x1c.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\Explorerieinstal.exe tmpanfn5x1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\NPPDF32Acrobat19.10.20064.310990.exe tmpanfn5x1c.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-00001809_31bf3856ad364e35_10.0.19041.1_none_ab0d46cd35b2a785\OperatingMicrosoft.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tzutil.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5c7655d2e64a1466\tzutilMicrosoft.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\x86_microsoft-windows-r..r-wow64-c.resources_31bf3856ad364e35_10.0.19041.1_it-it_5bcec5042a1f2315\operativordvgogl3210.0.19041.1.exe tmpanfn5x1c.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\SystemKeyDistributionService.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-m..extension.resources_31bf3856ad364e35_10.0.19041.1_it-it_e23a3330dad5b92a\dlnashextNamespace.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-perceptiondevice-dll_31bf3856ad364e35_10.0.19041.746_none_6f6484da1224a66d\MicrosoftWindows.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.19041.1_none_09c72ca259d82b1b\Unicodemsiexec.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..calaccountmigplugin_31bf3856ad364e35_10.0.19041.746_none_bd71aec15d49459b\OperatingNgcLocalAccountMigPlugin.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_system.servicemodel.web.resources_31bf3856ad364e35_4.0.15805.0_de-de_ea29d01d75de827c\Systemresources.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..direction.resources_31bf3856ad364e35_10.0.19041.1_en-us_2d149596d70f7a77\Windowsrdpclip.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netplwiz_31bf3856ad364e35_10.0.19041.610_none_33c1bfdd48a2f243\SystemOperating.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-qedit.resources_31bf3856ad364e35_10.0.19041.1_es-es_d25aa15db47187f2\QEditWindows.exe tmpanfn5x1c.exe File opened for modification C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\WindowsMicrosoft.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ivesyncprovisioning_31bf3856ad364e35_10.0.19041.264_none_814a9be57f374dff\easwrtOperating.exe tmpanfn5x1c.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Printing.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\resourcesFramework.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthcentercpl_31bf3856ad364e35_10.0.19041.1_none_0695fb573d001907\OperatingACTIONCENTERCPL10.0.19041.1.160101.0800.exe tmpanfn5x1c.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\SystemSystem.exe tmpanfn5x1c.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.Resources\v4.0_1.0.0.0_it_31bf3856ad364e35\resourcesWindows.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\x86_netfx35linq-system.data.entity_31bf3856ad364e35_10.0.19041.1_none_8ce6a8cec293b8f8\Frameworkdata3.5.30729.9141.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rbridging.resources_31bf3856ad364e35_10.0.19041.1_es-es_f324b80adee1eacc\SystemWindows.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_sl-si_4892e179afed964c\MicrosoftOperacijski.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-peauth_31bf3856ad364e35_10.0.19041.1266_none_7ce519ea3ed77360\MicrosoftOperating.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate.resources_31bf3856ad364e35_10.0.19041.1_de-de_25768d4577baec19\WindowsMicrosoft.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mfaudiocnv_31bf3856ad364e35_10.0.19041.746_none_f1d2f6b3087cdcfe\SystemConverter.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-kerberos_31bf3856ad364e35_10.0.19041.1288_none_65f32e079a5e0e0c\kerberoskerberos10.0.19041.1288.160101.0800.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.19041.1_es-es_57cd46da8c032f2a\vdsutilvdsutil.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkstatus_31bf3856ad364e35_10.0.19041.746_none_f19d528b8fe3a155\MicrosoftWindows.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\x86_microsoft-windows-i..ngsupport.resources_31bf3856ad364e35_11.0.19041.1_de-de_1b967932deb206df\MSHTMLERMSHTMLER.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lock-controller_31bf3856ad364e35_10.0.19041.153_none_d7bf694ec2d9771d\OperatingWindows.exe tmpanfn5x1c.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Routing.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\Routingresources.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-legacysystemsettings_31bf3856ad364e35_10.0.19041.746_none_0471ebf8f86894e4\WindowsWindows10.0.19041.746.exe tmpanfn5x1c.exe File created C:\Windows\diagnostics\system\Networking\MicrosoftSystem10.0.19041.1.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4b68bf677bc21270\WindowsMQUTIL.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil.resources_31bf3856ad364e35_10.0.19041.1_de-de_dd230466ceb1559f\OperatingBetriebssystem.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nddeapi_31bf3856ad364e35_10.0.19041.1_none_fa78fa00ff1dea7d\OperatingNDDEAPI.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ddriverprovider-dll_31bf3856ad364e35_10.0.19041.1110_none_e75d71f769f6f55b\signdrvMicrosoft.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ame-frame.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_0a7cc4c136e01007\ApplicationFrameWindows10.0.19041.1.160101.0800.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-0000041f_31bf3856ad364e35_10.0.19041.1_none_bf08c1df28da0b94\kbdtuqWindows.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dns-client-winrnr_31bf3856ad364e35_10.0.19041.546_none_419c4441e34643dc\MicrosoftWindows.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dskquota.resources_31bf3856ad364e35_10.0.19041.1_es-es_b6c11e9bff202189\DSKQUOTAoperativo.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ntication.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_abdd37a70cfa4948\dexploitationWindows.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_8b2066136dd02eb6\drvstoreSystem.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft.transactions.bridge.resources_b03f5f7f11d50a3a_4.0.15805.0_es-es_bdc9e5874e819e0d\Transactionsresources.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..nce-tools.resources_31bf3856ad364e35_10.0.19041.1_it-it_66ed75d007bbb91f\Windowsoperativo.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-van.resources_31bf3856ad364e35_10.0.19041.1_es-es_30cc4289c0e02807\operativoSistema.exe tmpanfn5x1c.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\v4.0_3.0.0.0_it_31bf3856ad364e35\PowerShellSistema.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..olocation.resources_31bf3856ad364e35_10.0.19041.1_it-it_07360b61c524f137\SistemaSettingsHandlersGeolocation10.0.19041.1.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wwanui.resources_31bf3856ad364e35_10.0.19041.1_es-es_c59838074a0d66e2\wwanprefWWanConn.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_a4db5a4ee9678060\dccwWindows.exe tmpanfn5x1c.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\operativoWindows10.0.19041.1.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-aspbinaries_31bf3856ad364e35_10.0.19041.906_none_6aa8dc8fc623977c\browscapInternet.exe tmpanfn5x1c.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\SystemWindows.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timedate_31bf3856ad364e35_10.0.19041.1_none_459d39f96327787a\SystemOperating10.0.19041.1.160101.0800.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit.resources_31bf3856ad364e35_10.0.19041.1_es-es_45ad109371d70ae6\MicrosoftWindows.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.1_none_6b92f924ed7df79b\MAPI32FIXMAPI.exe tmpanfn5x1c.exe File created C:\Windows\diagnostics\system\Video\it-IT\WindowsMicrosoft.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icacls.resources_31bf3856ad364e35_10.0.19041.1_es-es_ab888a9b26f970d6\icaclsMicrosoft10.0.19041.1.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..otect-dll.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_7c95fdf5d16031b4\mskeyprotectMicrosoft.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..i-appcore.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_171263d17773c7dd\Windowstwinapi.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximity-servicepal_31bf3856ad364e35_10.0.19041.1_none_b8308fb28e1c8115\OperatingProximityServicePal10.0.19041.1.exe tmpanfn5x1c.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.Thread\v4.0_4.0.0.0__b03f5f7f11d50a3a\ThreadingThreading4.8.4084.0.exe tmpanfn5x1c.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets.Resources\v4.0_1.0.0.0_de_31bf3856ad364e35\Windowsresources.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\msil_microsoft.powershell.utility.activities_31bf3856ad364e35_10.0.19041.1_none_1f9c329c516e63d9\PowerShellUtility10.0.19041.1.exe tmpanfn5x1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ctivities.resources_31bf3856ad364e35_10.0.19041.1_en-us_304542db3f07c7d4\SystemMicrosoft.exe tmpanfn5x1c.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpanfn5x1c.exe - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString tmpanfn5x1c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier tmpanfn5x1c.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tmpanfn5x1c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString tmpanfn5x1c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier tmpanfn5x1c.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tmpanfn5x1c.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3612 tmpanfn5x1c.exe 3612 tmpanfn5x1c.exe 3612 tmpanfn5x1c.exe 3612 tmpanfn5x1c.exe 3612 tmpanfn5x1c.exe 3612 tmpanfn5x1c.exe 3500 tmpanfn5x1c.exe 3500 tmpanfn5x1c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpanfn5x1c.exe"C:\Users\Admin\AppData\Local\Temp\tmpanfn5x1c.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3612
-
C:\Users\Admin\AppData\Local\Temp\tmpanfn5x1c.exeC:\Users\Admin\AppData\Local\Temp\tmpanfn5x1c.exe1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3500
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\System\Ole DB\en-US\SystemWindows.exe
- Size 2.3MB
- SHA256 e5cc4a232bd7bfcc2a57174554c284527bce0e2f494f1e9190c9c4c469985eca
- MD5 a00f59737d82c8df1c974b50e80e03f8
- SHA1 470a71a8d4645e9aa96b36f5b99a609f90faf142
- SHA512 de9ae03b9a20bf262cfe34af0f759ada873eb004a51a9f6d8ae88e325a9a34e4530b68daa699e255f05bb379fdedad6506c4edb6aa264219b3293b96b0163bc7
- SSDEEP 24576:+VYbWzOqXT4XFrhe1v/xRZJQnxBrabsM8KGH7Co0OLeGrIocE5lArjPPW:XWzORX1he1HxRqr08KGbNLeGMb4unW
- TLSH T12DB57C10A3DAF491F67E1F3498B157520E757D268A32C57ABAEC398DF83C2137924722
- MD5 SHA1 SHA512 SSDEEP TLSH