Analysis
- max time kernel
38s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:24
Static task
static1
Behavioral task
behavioral1
Sample
f4a0df4b5eb072790d33c4207f4b273033a0b6b3b5335f0e8d09d8b32cb36157.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f4a0df4b5eb072790d33c4207f4b273033a0b6b3b5335f0e8d09d8b32cb36157.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target f4a0df4b5eb072790d33c4207f4b273033a0b6b3b5335f0e8d09d8b32cb36157.exe
- Size 42KB
- Sample201109-dp5e6nbgex
- SHA256 f4a0df4b5eb072790d33c4207f4b273033a0b6b3b5335f0e8d09d8b32cb36157
- MD5 ed62ad4f1b9fcb994da9e26297863025
- SHA1 8969c1215aa788f3697c6f4ec0cb877c687b36e0
- SHA512 86aa18030481fb46e067b23b8ec0ca7068ef7fc9bd24d052e1fb6950923ce512284de40858f67e85deb8720605807d3adc70f6496cb98f95bf2a881ddbd50dab
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x000800000000068f-1.dat aspack_v212_v242 behavioral2/files/0x000800000000068f-2.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5024 BIJ.exe - Drops file in Program Files directory 275 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE BIJ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe BIJ.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe BIJ.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\elevation_service.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe BIJ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe BIJ.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe BIJ.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\OneConnect.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe BIJ.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe BIJ.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Music.UI.exe BIJ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE BIJ.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe BIJ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubWin32.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe BIJ.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{0C5D4CDF-5D9D-4019-A7CB-FAAD082B42AB}\86.0.4240.111_chrome_installer.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe BIJ.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE BIJ.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe BIJ.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe BIJ.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe BIJ.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\XboxIdp.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe BIJ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe BIJ.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE BIJ.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe BIJ.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe BIJ.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\chrome_pwa_launcher.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe BIJ.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxMail.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe BIJ.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe BIJ.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe BIJ.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe BIJ.exe File opened for modification C:\Program Files\7-Zip\7zG.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe BIJ.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\MessagingApplication.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE BIJ.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteshare.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE BIJ.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe BIJ.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{0C5D4CDF-5D9D-4019-A7CB-FAAD082B42AB}\CR_8D4CF.tmp\setup.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxTsr.exe BIJ.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\86.0.4240.111\86.0.4240.111_chrome_installer.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe BIJ.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE BIJ.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe BIJ.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe BIJ.exe File opened for modification C:\Program Files\Windows Defender\MpUXSrv.exe BIJ.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.App.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE BIJ.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe BIJ.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe BIJ.exe File opened for modification C:\Program Files\Windows Defender\MSASCuiL.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Time.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe BIJ.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe BIJ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe BIJ.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe BIJ.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe BIJ.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe BIJ.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\setup.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE BIJ.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxClickHandler.exe BIJ.exe File opened for modification C:\Program Files\7-Zip\7z.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe BIJ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe BIJ.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe BIJ.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe BIJ.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe BIJ.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe BIJ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe BIJ.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\notification_helper.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE BIJ.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe BIJ.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUMCF92.tmp\GoogleUpdateSetup.exe BIJ.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe BIJ.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe BIJ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE BIJ.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe BIJ.exe File opened for modification C:\Program Files\Windows Mail\wab.exe BIJ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE BIJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE BIJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe BIJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe BIJ.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4772 wrote to memory of 5024 4772 f4a0df4b5eb072790d33c4207f4b273033a0b6b3b5335f0e8d09d8b32cb36157.exe 73 PID 4772 wrote to memory of 5024 4772 f4a0df4b5eb072790d33c4207f4b273033a0b6b3b5335f0e8d09d8b32cb36157.exe 73 PID 4772 wrote to memory of 5024 4772 f4a0df4b5eb072790d33c4207f4b273033a0b6b3b5335f0e8d09d8b32cb36157.exe 73 PID 5024 wrote to memory of 1012 5024 BIJ.exe 80 PID 5024 wrote to memory of 1012 5024 BIJ.exe 80 PID 5024 wrote to memory of 1012 5024 BIJ.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4a0df4b5eb072790d33c4207f4b273033a0b6b3b5335f0e8d09d8b32cb36157.exe"C:\Users\Admin\AppData\Local\Temp\f4a0df4b5eb072790d33c4207f4b273033a0b6b3b5335f0e8d09d8b32cb36157.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\BIJ.exeC:\Users\Admin\AppData\Local\Temp\BIJ.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2b41118a.bat" "3⤵PID:1012
-
-