Analysis
-
max time kernel
151s -
max time network
6s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
04-05-2020 23:30
Static task
static1
Behavioral task
behavioral1
Sample
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe
Resource
win10v200430
General
-
Target
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe
-
Size
69KB
-
MD5
3a601ee68000508d58ea12203449a202
-
SHA1
9068567b2b3fdae864ca9b1fb9013d0305e3ca83
-
SHA256
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5
-
SHA512
176d60567b2bcf89aa6338f3f14b22ee2592e4ea6349c0a51d67e5b7655de611c2a6e58495cab8d9c5c26deaef03ad19852a0f32cd37466fa3241d61395527b0
Malware Config
Extracted
C:\Users\Admin\49C13C-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
Extracted
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\49C13C-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
Extracted
C:\Program Files\Microsoft Office\Office14\49C13C-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
Extracted
C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\49C13C-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
Extracted
C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\49C13C-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
Extracted
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\49C13C-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
Signatures
-
Suspicious behavior: EnumeratesProcesses 19325 IoCs
Processes:
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exepid process 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 4076 cmd.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1900 taskkill.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe Token: SeImpersonatePrivilege 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe Token: SeBackupPrivilege 5064 vssvc.exe Token: SeRestorePrivilege 5064 vssvc.exe Token: SeAuditPrivilege 5064 vssvc.exe Token: SeDebugPrivilege 1900 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.execmd.exedescription pid process target process PID 1064 wrote to memory of 832 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe vssadmin.exe PID 1064 wrote to memory of 832 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe vssadmin.exe PID 1064 wrote to memory of 832 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe vssadmin.exe PID 1064 wrote to memory of 832 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe vssadmin.exe PID 1064 wrote to memory of 3992 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe notepad.exe PID 1064 wrote to memory of 3992 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe notepad.exe PID 1064 wrote to memory of 3992 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe notepad.exe PID 1064 wrote to memory of 3992 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe notepad.exe PID 1064 wrote to memory of 4076 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe cmd.exe PID 1064 wrote to memory of 4076 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe cmd.exe PID 1064 wrote to memory of 4076 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe cmd.exe PID 1064 wrote to memory of 4076 1064 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe cmd.exe PID 4076 wrote to memory of 1900 4076 cmd.exe taskkill.exe PID 4076 wrote to memory of 1900 4076 cmd.exe taskkill.exe PID 4076 wrote to memory of 1900 4076 cmd.exe taskkill.exe PID 4076 wrote to memory of 1900 4076 cmd.exe taskkill.exe -
Netwalker
Ransomware believed to be a variant of MailTo.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 832 vssadmin.exe -
Drops file in Program Files directory 7486 IoCs
Processes:
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\49C13C-Readme.txt 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18180_.WMF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jre7\lib\security\cacerts 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Things\SHOVEL.WAV 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\MSSPC.ECF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\XMLSDK5.CHM 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00636_.WMF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0227558.JPG 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152594.WMF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Clarity.xml 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152702.WMF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DVA.api 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN095.XML 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.common_2.10.1.v20140901-1043.jar 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239943.WMF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0199036.WMF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18228_.WMF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00014_.WMF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Couture.xml 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\49C13C-Readme.txt 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\ACCTBOX.POC 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME23.CSS 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Halifax 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Belize 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Montevideo 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03513_.WMF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD10308_.GIF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File created C:\Program Files\Java\jre7\lib\amd64\49C13C-Readme.txt 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00669_.WMF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Anchorage 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\49C13C-Readme.txt 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File created C:\Program Files\Microsoft Office\Office14\1033\Bibliography\49C13C-Readme.txt 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\49C13C-Readme.txt 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21332_.GIF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21327_.GIF 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe"C:\Users\Admin\AppData\Local\Temp\27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\49C13C-Readme.txt"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\B00C.tmp.bat"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 10643⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken