Analysis
-
max time kernel
167s -
max time network
193s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
13-08-2020 17:42
Static task
static1
Behavioral task
behavioral1
Sample
Corporate_Detail-June.2020.exe
Resource
win10v200722
General
-
Target
Corporate_Detail-June.2020.exe
-
Size
1.3MB
-
MD5
6b083c1bfd21eea2a3f18283f1f3c5f5
-
SHA1
929b10f78565660535a07917d144d00b0c117571
-
SHA256
f2363a355fe226cb2f7f1afa72daecc5edfe1cb0edc1295856fb3f874d941b6d
-
SHA512
1ef2561ac5784bb90a1d39ab82f6f01122453bbe22cd55fa0a49aa534a7ece00c48b2bf1d31537e3fc5a447d1293bc23165c6a1fb00df2b3fda37a2eee62ee71
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\HACKED.txt
smaug
http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion
Signatures
-
Smaug
Ransomware-as-a-service first seen marketed on forums etc. in early 2020.
-
Drops file in Drivers directory 2 IoCs
Processes:
11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\drivers\gmreadme.txt.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe -
Executes dropped EXE 1 IoCs
Processes:
11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exepid process 496 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
JavaScript code in executable 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe js C:\Users\Admin\AppData\Local\Temp\11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe js -
Drops file in System32 directory 356 IoCs
Processes:
11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exedescription ioc process File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnxxcl3.inf_amd64_0fb0ea0c17a53da0\xrConfCL0.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNBX9WPIPELINECONFIG.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsacl1.inf_amd64_8adcb7af71f53089\saacps.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\Licenses\neutral\OEM\Professional\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\SyncAppvPublishingServer.vbs.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\tcpbidi.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnekcl2.inf_amd64_0a4ef5f40c1abe07\EK-PDL-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnepcl2.inf_amd64_5940f4dc3bf9366e\EP0LXPM0-PipelineConfig.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnepcl2.inf_amd64_5940f4dc3bf9366e\EP0NXSB0-PipelineConfig.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\Licenses\neutral\Volume\Professional\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\catroot2\dberr.txt.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\spool\tools\Microsoft Print To PDF\MPDW-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnbrcl1.inf_amd64_205cfd311a6b4e83\BRIBMF05-PIPELINECONFIG.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnfxcl2.inf_amd64_f26eeb7da72ee32b\fxpclc2-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnokcl2.inf_amd64_1e45a4f567fdae98\OKV4PCL6-PipelineConfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_468bda717012acbd\Amd64\MSxpsPCL6-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_faa2804656671550\MPDW-PDC.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prntscl2.inf_amd64_710ef19434c930a9\tsunicl2PipelineConfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\Printing_Admin_Scripts\en-US\prndrvr.vbs.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\@VpnToastIcon.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNB_BIDIWSD1.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnkycl1.inf_amd64_d830c6577c8a2c44\kyw8-kpsl-mono-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnepcl2.inf_amd64_5940f4dc3bf9366e\EP0NXS90-PipelineConfig.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\Printing_Admin_Scripts\en-US\prnqctl.vbs.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\icsxml\osinfo.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNBXAQPIPELINECONFIG.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prndlcl1.inf_amd64_dbe82d5f3b18ec9a\deacevents.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prndlclf.inf_amd64_efe1d550b7437499\dlclf3-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnfxcl2.inf_amd64_f26eeb7da72ee32b\fxpclcolor-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\Sysprep\Panther\IE\diagwrn.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\spool\tools\Microsoft Print To PDF\MPDW_devmode_map.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\Volume\Professional\license.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnbrcl1.inf_amd64_205cfd311a6b4e83\BRIBME0A_300-PipelineConfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNB_BIDIWSD3.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prndlcl1.inf_amd64_dbe82d5f3b18ec9a\deSP-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prndlclf.inf_amd64_efe1d550b7437499\dlclf4-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnlxclv.inf_amd64_e0d61070674d9678\LXclVB.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_468bda717012acbd\Amd64\MSxpsPS-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsacl1.inf_amd64_8adcb7af71f53089\saBPS-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\NdfEventView.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnbrcl1.inf_amd64_205cfd311a6b4e83\BRIBMM0A-PIPELINECONFIG.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacl1.inf_amd64_5cab2573ec016b93\CNN08CL1_bidiwsd.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prntscl3.inf_amd64_7587d7a73d91986f\tsmxucl3-PipelineConfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\Printing_Admin_Scripts\en-US\prncnfg.vbs.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnepcl2.inf_amd64_5940f4dc3bf9366e\EP0LXPA0-PipelineConfig.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhpcl5.inf_amd64_d79d88c2b839182e\amd64\HP-PS3-pipelineConfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnkycl1.inf_amd64_d830c6577c8a2c44\kyw8bidiwsd.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnfxcl2.inf_amd64_f26eeb7da72ee32b\fxxpsbw-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnkmcl4.inf_amd64_01e54ba5b8932b04\kocl4-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnkycl1.inf_amd64_d830c6577c8a2c44\kyw8bidispm.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\Speech_OneCore\common\en-US\Tokens_VoiceActivation_en-US.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\@AudioToastIcon.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNBXA1PIPELINECONFIG.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_fd9b9365c7be8df0\I386\unishare-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\@WindowsHelloFaceToastIcon.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\@WwanSimLockIcon.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNBX9NPIPELINECONFIG.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prntscl2.inf_amd64_710ef19434c930a9\tsunicl2.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SysWOW64\winrm.vbs.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prndlcl1.inf_amd64_dbe82d5f3b18ec9a\deCP6-pipelineconfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnlxclv.inf_amd64_e0d61070674d9678\LXclVBW.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\System32\Speech_OneCore\common\tokens.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe -
Drops file in Program Files directory 11151 IoCs
Processes:
11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-200_contrast-white.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Office\BooleanIntersect.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.contrast-white_scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_unshare_18.svg.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-125_contrast-black.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\604_32x32x32.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6454_48x48x32.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailSmallTile.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\StarClub\challenge_spider.jpg.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1249_24x24x32.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-200.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\LargeTile.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2017.125.40.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.scale-200.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1251_40x40x32.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7205_20x20x32.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OneConnectAppList.scale-200.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSplashScreen.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\10911_40x40x32.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookWideTile.scale-125.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ms_16x11.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Windows Defender\ThirdPartyNotices.txt.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W1.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-60.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailBadge.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupMedTile.scale-150.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\clapping.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-64.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\PlayStore_icon.svg.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.targetsize-16.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\PopUp\Pop_up_Warning.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerMedTile.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-black_scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\AppxManifest.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-250.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-250.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\OneConnectLargeTile.scale-125.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Office\Print.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_WorriedEye.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookSmallTile.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-64.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarMediumTile.scale-125.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Jumbo\jumbo_12c.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\yelplogo.scale-200.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailLargeTile.scale-150.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\il_16x11.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-200.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-256.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\DailyChallenges\Popup\Coin.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe -
Drops file in Windows directory 13899 IoCs
Processes:
11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exedescription ioc process File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-h..statement.resources_31bf3856ad364e35_10.0.15063.0_en-us_41454b4c36518bb9\vofflps.rtf.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_prncacla.inf_31bf3856ad364e35_10.0.15063.0_none_b5e633933a90d26d\Amd64\CNB_BIDIWSD1.XML.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7734_36x36x32.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\AppxBlockMap.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\MedTile.scale-100_contrast-white.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-16.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.15063.0_none_e2c589338a2b8b9d\symbase.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\speechless.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\10912_40x40x32.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-30_altform-unplated.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-48.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\en\DropSqlPersistenceProviderSchema.sql.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\INF\UGTHRSVC\gthrctr.h.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..trast-black.cortana_31bf3856ad364e35_10.0.15063.0_none_9ee2bb765647bac9\AppListIcon.targetsize-96.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_prnnecl2.inf_31bf3856ad364e35_10.0.15063.0_none_7c637ba618f8275f\nehb2-PipelineConfig.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\PLA\Rules\Rules.System.Diagnostics.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..om-miantuan.cortana_31bf3856ad364e35_10.0.15063.0_none_edfba5bd1d34275c\AppListIcon.targetsize-80.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-miracastview.appxsetup_31bf3856ad364e35_10.0.15063.0_none_636216c3f1ed6f15\appxmanifest.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Applications\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Applications\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..rammar.0809.cortana_31bf3856ad364e35_10.0.15063.0_none_edd19eb85dbe3e64\ReactiveAgentsCommonRes.0809.bin.gz.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..rammar.0c09.cortana_31bf3856ad364e35_10.0.15063.0_none_86da8d1a1feb7a91\PPIVoiceAgents.0c09.cfg.gz.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dot3svc.resources_31bf3856ad364e35_10.0.15063.0_en-us_182c835370800dbb\Rules.System.Wired.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\LargeTile.scale-125.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RedistList\FrameworkList.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SystemApps\ContactSupport_cw5n1h2txyewy\Assets\LargeTile.scale-125_contrast-white.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Assets\Icons\custom-Cortana\contrast-white\SmallTile.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.15063.0_none_13cc520b866eaf57\tokens_enAU.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.15063.0_none_c4f067d86940c645\Rules.System.Diagnostics.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-installpersistsqlstate_sql_b03f5f7f11d50a3a_4.0.15552.17062_none_6039e909af7f5d55\InstallPersistSqlState.sql.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsAppList.scale-125.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SystemApps\ContactSupport_cw5n1h2txyewy\Assets\SplashWideTile.scale-400_contrast-white.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp10.scale-125.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\friends.scale-200.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\SmallTile.scale-125.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\HeroHelp\Scenario2RTL.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Assets\MusicRecoPlaceholder.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\BingConfiguration\BingConfiguration_en-CA.xml.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.15063.0_none_d3272800f8d2d859\DefaultSquareTileLogo2.scale-80.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-aspnet_webadmin_images_b03f5f7f11d50a3a_4.0.14917.0_none_93672888b2310fc6\image2.gif.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-colorize.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\eu_16x11.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-60.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\IncomingCall.scale-125_contrast-black.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..om-miantuan.cortana_31bf3856ad364e35_10.0.15063.0_none_edfba5bd1d34275c\AppListIcon.targetsize-96.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\common\Classic_Speed_Run_Unearned_small.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\SmallTile.scale-125.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\Exchange.Theme-Light_Scale-150.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-40.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\MedTile.scale-125.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..trast-white.cortana_31bf3856ad364e35_10.0.15063.0_none_014ea5da0b60c418\AppListIcon.targetsize-96_altform-unplated.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-installroles_sql_b03f5f7f11d50a3a_4.0.14917.0_none_866caf843d2b2105\UninstallRoles.sql.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Workflow\Icon_Layout.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\nl_60x42.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\MedTile.scale-100.png.11bdd939-1d45-421c-9be0-0addcdc8181c 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Corporate_Detail-June.2020.exepid process 3740 Corporate_Detail-June.2020.exe 3740 Corporate_Detail-June.2020.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Corporate_Detail-June.2020.exedescription pid process target process PID 3740 wrote to memory of 496 3740 Corporate_Detail-June.2020.exe 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe PID 3740 wrote to memory of 496 3740 Corporate_Detail-June.2020.exe 11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Corporate_Detail-June.2020.exe"C:\Users\Admin\AppData\Local\Temp\Corporate_Detail-June.2020.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe"C:\Users\Admin\AppData\Local\Temp\11bdd939-1d45-421c-9be0-0addcdc8181c_windows.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:496