Analysis
- max time kernel
36s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:24
Static task
static1
Behavioral task
behavioral1
Sample
0685658d4e346639a3eb78e26f9ceeffd0790be72538dd38a6142d8673d1b577.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0685658d4e346639a3eb78e26f9ceeffd0790be72538dd38a6142d8673d1b577.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 0685658d4e346639a3eb78e26f9ceeffd0790be72538dd38a6142d8673d1b577.exe
- Size 479KB
- Sample201109-cw29d9knee
- SHA256 0685658d4e346639a3eb78e26f9ceeffd0790be72538dd38a6142d8673d1b577
- MD5 a3e81c61d2fdea2a94438184c3db6b37
- SHA1 e58aef29ad88a1903d9841c137eacc3f6b38420f
- SHA512 b6bc2edb4606a60df160d40fe45ad54dc26b6994fc6d33d59df9430929414af1a8287e14fea2dcd4c7f80fe944c0fe60c10efaea0ac1ef92c6ce6e8bdc7bb69c
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x0008000000000687-1.dat aspack_v212_v242 behavioral2/files/0x0008000000000687-2.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3964 QXHUXV.exe - Drops file in Program Files directory 275 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe QXHUXV.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe QXHUXV.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\notification_helper.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe QXHUXV.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe QXHUXV.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\elevation_service.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe QXHUXV.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe QXHUXV.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE QXHUXV.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe QXHUXV.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.App.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\86.0.4240.111_chrome_installer.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE QXHUXV.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE QXHUXV.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe QXHUXV.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe QXHUXV.exe File opened for modification C:\Program Files\Windows Defender\MpUXSrv.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_2BD8F.tmp\setup.exe QXHUXV.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\chrome_pwa_launcher.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe QXHUXV.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\XboxIdp.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe QXHUXV.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe QXHUXV.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe QXHUXV.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxMail.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe QXHUXV.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe QXHUXV.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe QXHUXV.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Time.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe QXHUXV.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE QXHUXV.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe QXHUXV.exe File opened for modification C:\Program Files\7-Zip\7zG.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE QXHUXV.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe QXHUXV.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe QXHUXV.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe QXHUXV.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE QXHUXV.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteshare.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe QXHUXV.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE QXHUXV.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE QXHUXV.exe File opened for modification C:\Program Files\Windows Defender\MSASCuiL.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE QXHUXV.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe QXHUXV.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe QXHUXV.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubWin32.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\86.0.4240.111\86.0.4240.111_chrome_installer.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUMED0D.tmp\GoogleUpdateSetup.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe QXHUXV.exe File opened for modification C:\Program Files\Windows Mail\wab.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxTsr.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\MessagingApplication.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe QXHUXV.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxClickHandler.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe QXHUXV.exe File opened for modification C:\Program Files\7-Zip\7z.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE QXHUXV.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe QXHUXV.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\OneConnect.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe QXHUXV.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe QXHUXV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Music.UI.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE QXHUXV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe QXHUXV.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\setup.exe QXHUXV.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe QXHUXV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe QXHUXV.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 944 wrote to memory of 3964 944 0685658d4e346639a3eb78e26f9ceeffd0790be72538dd38a6142d8673d1b577.exe 76 PID 944 wrote to memory of 3964 944 0685658d4e346639a3eb78e26f9ceeffd0790be72538dd38a6142d8673d1b577.exe 76 PID 944 wrote to memory of 3964 944 0685658d4e346639a3eb78e26f9ceeffd0790be72538dd38a6142d8673d1b577.exe 76 PID 3964 wrote to memory of 2844 3964 QXHUXV.exe 81 PID 3964 wrote to memory of 2844 3964 QXHUXV.exe 81 PID 3964 wrote to memory of 2844 3964 QXHUXV.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\0685658d4e346639a3eb78e26f9ceeffd0790be72538dd38a6142d8673d1b577.exe"C:\Users\Admin\AppData\Local\Temp\0685658d4e346639a3eb78e26f9ceeffd0790be72538dd38a6142d8673d1b577.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\QXHUXV.exeC:\Users\Admin\AppData\Local\Temp\QXHUXV.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\08f23f72.bat" "3⤵PID:2844
-
-