Analysis
- max time kernel
57s - max time network
66s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:28
Static task
static1
Behavioral task
behavioral1
Sample
9b369c81a319f33b0bcb091c2b4f4a1d98d5fcfdfc53111d9f2f4c2f66996cf7.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9b369c81a319f33b0bcb091c2b4f4a1d98d5fcfdfc53111d9f2f4c2f66996cf7.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 9b369c81a319f33b0bcb091c2b4f4a1d98d5fcfdfc53111d9f2f4c2f66996cf7.exe
- Size 10.3MB
- Sample201109-9lb8f4lsfx
- SHA256 9b369c81a319f33b0bcb091c2b4f4a1d98d5fcfdfc53111d9f2f4c2f66996cf7
- MD5 7ae418799dbd7ebe577b6a51ef3bcd83
- SHA1 48e8445a18de90961b28e703f7f63ce18f76d43e
- SHA512 b14bb52fdeb7ffdb8ed05d8b0043f5be9d5efd1eb6fd00d791833b29e2ec35664cebf6512fe56266ecf9b7665dcfedc0746a37927b744e651ec4e6dfdbeeb2de
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x000200000001ab59-1.dat aspack_v212_v242 behavioral2/files/0x000200000001ab59-2.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3160 oNGZCd.exe - Drops file in Program Files directory 275 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe oNGZCd.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\setup.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_2BD8F.tmp\setup.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe oNGZCd.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe oNGZCd.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe oNGZCd.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteshare.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe oNGZCd.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxClickHandler.exe oNGZCd.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Time.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE oNGZCd.exe File opened for modification C:\Program Files\Windows Defender\MpUXSrv.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\MessagingApplication.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe oNGZCd.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe oNGZCd.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxTsr.exe oNGZCd.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\chrome_pwa_launcher.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe oNGZCd.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe oNGZCd.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE oNGZCd.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe oNGZCd.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe oNGZCd.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe oNGZCd.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe oNGZCd.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe oNGZCd.exe File opened for modification C:\Program Files\7-Zip\7z.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe oNGZCd.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubWin32.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe oNGZCd.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe oNGZCd.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\notification_helper.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUMED0D.tmp\GoogleUpdateSetup.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE oNGZCd.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe oNGZCd.exe File opened for modification C:\Program Files\Windows Defender\MSASCuiL.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe oNGZCd.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Music.UI.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.App.exe oNGZCd.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe oNGZCd.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe oNGZCd.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\86.0.4240.111\86.0.4240.111_chrome_installer.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe oNGZCd.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE oNGZCd.exe File opened for modification C:\Program Files\7-Zip\7zG.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\XboxIdp.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxMail.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe oNGZCd.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe oNGZCd.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe oNGZCd.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe oNGZCd.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\OneConnect.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\86.0.4240.111_chrome_installer.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe oNGZCd.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe oNGZCd.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE oNGZCd.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE oNGZCd.exe File opened for modification C:\Program Files\Windows Mail\wab.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE oNGZCd.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe oNGZCd.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe oNGZCd.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe oNGZCd.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe oNGZCd.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\elevation_service.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe oNGZCd.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe oNGZCd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe oNGZCd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe oNGZCd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe oNGZCd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE oNGZCd.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 884 9b369c81a319f33b0bcb091c2b4f4a1d98d5fcfdfc53111d9f2f4c2f66996cf7.exe 884 9b369c81a319f33b0bcb091c2b4f4a1d98d5fcfdfc53111d9f2f4c2f66996cf7.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 884 wrote to memory of 3160 884 9b369c81a319f33b0bcb091c2b4f4a1d98d5fcfdfc53111d9f2f4c2f66996cf7.exe 75 PID 884 wrote to memory of 3160 884 9b369c81a319f33b0bcb091c2b4f4a1d98d5fcfdfc53111d9f2f4c2f66996cf7.exe 75 PID 884 wrote to memory of 3160 884 9b369c81a319f33b0bcb091c2b4f4a1d98d5fcfdfc53111d9f2f4c2f66996cf7.exe 75 PID 3160 wrote to memory of 1528 3160 oNGZCd.exe 80 PID 3160 wrote to memory of 1528 3160 oNGZCd.exe 80 PID 3160 wrote to memory of 1528 3160 oNGZCd.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b369c81a319f33b0bcb091c2b4f4a1d98d5fcfdfc53111d9f2f4c2f66996cf7.exe"C:\Users\Admin\AppData\Local\Temp\9b369c81a319f33b0bcb091c2b4f4a1d98d5fcfdfc53111d9f2f4c2f66996cf7.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\oNGZCd.exeC:\Users\Admin\AppData\Local\Temp\oNGZCd.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\618b35d7.bat" "3⤵PID:1528
-
-