Analysis
- max time kernel
50s - max time network
102s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:24
Static task
static1
Behavioral task
behavioral1
Sample
17bc2318c64ce819e0a3609a8581f458c2d75d73dee30a74efdba8e0c07edf4d.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
17bc2318c64ce819e0a3609a8581f458c2d75d73dee30a74efdba8e0c07edf4d.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 17bc2318c64ce819e0a3609a8581f458c2d75d73dee30a74efdba8e0c07edf4d.exe
- Size 10.3MB
- Sample201109-caal5rb99e
- SHA256 17bc2318c64ce819e0a3609a8581f458c2d75d73dee30a74efdba8e0c07edf4d
- MD5 3baf073c8cea04c0c4f4bf259e272a07
- SHA1 6b7d86ec5c539cd8a0081b20d8c4ee46640e34e8
- SHA512 bb2f4c9dc4fa36dd59eb9276e6a0aaed950421235723dbd7e6ee93b189e88c71e3720bf40657016a71794a1bf47aa3c44281a0dac23f26d9d43028de685bb8da
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x000800000000068f-2.dat aspack_v212_v242 behavioral2/files/0x000800000000068f-1.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4940 osvOfjEL.exe - Drops file in Program Files directory 275 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE osvOfjEL.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubWin32.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe osvOfjEL.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe osvOfjEL.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe osvOfjEL.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe osvOfjEL.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe osvOfjEL.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe osvOfjEL.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe osvOfjEL.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe osvOfjEL.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe osvOfjEL.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\setup.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{0C5D4CDF-5D9D-4019-A7CB-FAAD082B42AB}\86.0.4240.111_chrome_installer.exe osvOfjEL.exe File opened for modification C:\Program Files\7-Zip\7z.exe osvOfjEL.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe osvOfjEL.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE osvOfjEL.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\notification_helper.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe osvOfjEL.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\chrome_pwa_launcher.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe osvOfjEL.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxClickHandler.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe osvOfjEL.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxMail.exe osvOfjEL.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe osvOfjEL.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe osvOfjEL.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\XboxIdp.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUMCF92.tmp\GoogleUpdateSetup.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE osvOfjEL.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe osvOfjEL.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxTsr.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe osvOfjEL.exe File opened for modification C:\Program Files\Windows Defender\MpUXSrv.exe osvOfjEL.exe File opened for modification C:\Program Files\Windows Defender\MSASCuiL.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe osvOfjEL.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.App.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\OneConnect.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{0C5D4CDF-5D9D-4019-A7CB-FAAD082B42AB}\CR_8D4CF.tmp\setup.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteshare.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE osvOfjEL.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe osvOfjEL.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\86.0.4240.111\86.0.4240.111_chrome_installer.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE osvOfjEL.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe osvOfjEL.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Time.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe osvOfjEL.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe osvOfjEL.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe osvOfjEL.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE osvOfjEL.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe osvOfjEL.exe File opened for modification C:\Program Files\Windows Mail\wab.exe osvOfjEL.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE osvOfjEL.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe osvOfjEL.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\MessagingApplication.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Music.UI.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe osvOfjEL.exe File opened for modification C:\Program Files\7-Zip\7zG.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe osvOfjEL.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe osvOfjEL.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\elevation_service.exe osvOfjEL.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe osvOfjEL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE osvOfjEL.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe osvOfjEL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe osvOfjEL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe osvOfjEL.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4800 17bc2318c64ce819e0a3609a8581f458c2d75d73dee30a74efdba8e0c07edf4d.exe 4800 17bc2318c64ce819e0a3609a8581f458c2d75d73dee30a74efdba8e0c07edf4d.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4800 wrote to memory of 4940 4800 17bc2318c64ce819e0a3609a8581f458c2d75d73dee30a74efdba8e0c07edf4d.exe 70 PID 4800 wrote to memory of 4940 4800 17bc2318c64ce819e0a3609a8581f458c2d75d73dee30a74efdba8e0c07edf4d.exe 70 PID 4800 wrote to memory of 4940 4800 17bc2318c64ce819e0a3609a8581f458c2d75d73dee30a74efdba8e0c07edf4d.exe 70 PID 4940 wrote to memory of 3408 4940 osvOfjEL.exe 79 PID 4940 wrote to memory of 3408 4940 osvOfjEL.exe 79 PID 4940 wrote to memory of 3408 4940 osvOfjEL.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\17bc2318c64ce819e0a3609a8581f458c2d75d73dee30a74efdba8e0c07edf4d.exe"C:\Users\Admin\AppData\Local\Temp\17bc2318c64ce819e0a3609a8581f458c2d75d73dee30a74efdba8e0c07edf4d.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\osvOfjEL.exeC:\Users\Admin\AppData\Local\Temp\osvOfjEL.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0aea0e4a.bat" "3⤵PID:3408
-
-