Analysis
- max time kernel
32s - max time network
106s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:28
Static task
static1
Behavioral task
behavioral1
Sample
fd22fefc5f2b5d29afaf068ba347b6630fe926898a2613fae52486bba53ece55.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fd22fefc5f2b5d29afaf068ba347b6630fe926898a2613fae52486bba53ece55.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target fd22fefc5f2b5d29afaf068ba347b6630fe926898a2613fae52486bba53ece55.exe
- Size 42KB
- Sample201109-bl3p1far2e
- SHA256 fd22fefc5f2b5d29afaf068ba347b6630fe926898a2613fae52486bba53ece55
- MD5 3799b9fdfc17ff1899b6f64eda6b5c43
- SHA1 7d380cf3bebfe9995bebaa7cdf205567511f2913
- SHA512 8fabafb12be1db8e573e25849947c48d7333b96cc93e54cf83bb82f679f14460f3c355f893a6e6e36fa09ed7512f9e287531b3e13a269f734c118b9a673e3d8f
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x000800000000068f-1.dat aspack_v212_v242 behavioral2/files/0x000800000000068f-2.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4980 PuqoOg.exe - Drops file in Program Files directory 275 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE PuqoOg.exe File opened for modification C:\Program Files\7-Zip\7z.exe PuqoOg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe PuqoOg.exe File opened for modification C:\Program Files\Windows Defender\MSASCuiL.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe PuqoOg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe PuqoOg.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe PuqoOg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxMail.exe PuqoOg.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE PuqoOg.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxTsr.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Music.UI.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe PuqoOg.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe PuqoOg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe PuqoOg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe PuqoOg.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.App.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe PuqoOg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe PuqoOg.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe PuqoOg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe PuqoOg.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe PuqoOg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE PuqoOg.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubWin32.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Time.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\XboxIdp.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe PuqoOg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxClickHandler.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE PuqoOg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\OneConnect.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe PuqoOg.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE PuqoOg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe PuqoOg.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe PuqoOg.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE PuqoOg.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe PuqoOg.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\elevation_service.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe PuqoOg.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\chrome_pwa_launcher.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE PuqoOg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe PuqoOg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe PuqoOg.exe File opened for modification C:\Program Files\Windows Mail\wab.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE PuqoOg.exe File opened for modification C:\Program Files\Windows Defender\MpUXSrv.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{0C5D4CDF-5D9D-4019-A7CB-FAAD082B42AB}\CR_8D4CF.tmp\setup.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe PuqoOg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE PuqoOg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe PuqoOg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe PuqoOg.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\setup.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe PuqoOg.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\notification_helper.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{0C5D4CDF-5D9D-4019-A7CB-FAAD082B42AB}\86.0.4240.111_chrome_installer.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe PuqoOg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe PuqoOg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe PuqoOg.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe PuqoOg.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteshare.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\86.0.4240.111\86.0.4240.111_chrome_installer.exe PuqoOg.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUMCF92.tmp\GoogleUpdateSetup.exe PuqoOg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE PuqoOg.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE PuqoOg.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe PuqoOg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe PuqoOg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\MessagingApplication.exe PuqoOg.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe PuqoOg.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4760 wrote to memory of 4980 4760 fd22fefc5f2b5d29afaf068ba347b6630fe926898a2613fae52486bba53ece55.exe 72 PID 4760 wrote to memory of 4980 4760 fd22fefc5f2b5d29afaf068ba347b6630fe926898a2613fae52486bba53ece55.exe 72 PID 4760 wrote to memory of 4980 4760 fd22fefc5f2b5d29afaf068ba347b6630fe926898a2613fae52486bba53ece55.exe 72 PID 4980 wrote to memory of 860 4980 PuqoOg.exe 80 PID 4980 wrote to memory of 860 4980 PuqoOg.exe 80 PID 4980 wrote to memory of 860 4980 PuqoOg.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd22fefc5f2b5d29afaf068ba347b6630fe926898a2613fae52486bba53ece55.exe"C:\Users\Admin\AppData\Local\Temp\fd22fefc5f2b5d29afaf068ba347b6630fe926898a2613fae52486bba53ece55.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\PuqoOg.exeC:\Users\Admin\AppData\Local\Temp\PuqoOg.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\14254f0c.bat" "3⤵PID:860
-
-