Analysis
- max time kernel
37s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:24
Static task
static1
Behavioral task
behavioral1
Sample
054960a260abc8459abaaa86facd46cd53742d10587f0091a276de63df99a43a.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
054960a260abc8459abaaa86facd46cd53742d10587f0091a276de63df99a43a.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 054960a260abc8459abaaa86facd46cd53742d10587f0091a276de63df99a43a.exe
- Size 479KB
- Sample201109-jvy6d85b46
- SHA256 054960a260abc8459abaaa86facd46cd53742d10587f0091a276de63df99a43a
- MD5 647afd37c572e14a0be22682f8952b77
- SHA1 5d8ba24896686e42f78b210c94369b33b2f9c154
- SHA512 4d1c0a6ff82c85a6cf9b54890a0f36a67fe09612b270e87306e060672e50fce7776d32b63a00c9a5dfdd0698e72c9def7c1ffd6f61cc5c63654dd849e9cfc214
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x0008000000000687-1.dat aspack_v212_v242 behavioral2/files/0x0008000000000687-2.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3312 pNbYIr.exe - Drops file in Program Files directory 275 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe pNbYIr.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE pNbYIr.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe pNbYIr.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe pNbYIr.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe pNbYIr.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe pNbYIr.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe pNbYIr.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE pNbYIr.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\OneConnect.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE pNbYIr.exe File opened for modification C:\Program Files\Windows Mail\wab.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe pNbYIr.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.App.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_2BD8F.tmp\setup.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe pNbYIr.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe pNbYIr.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe pNbYIr.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe pNbYIr.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\setup.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe pNbYIr.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe pNbYIr.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe pNbYIr.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe pNbYIr.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\notification_helper.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE pNbYIr.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteshare.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe pNbYIr.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe pNbYIr.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxTsr.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe pNbYIr.exe File opened for modification C:\Program Files\7-Zip\7z.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE pNbYIr.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\86.0.4240.111_chrome_installer.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe pNbYIr.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\chrome_pwa_launcher.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubWin32.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe pNbYIr.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe pNbYIr.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe pNbYIr.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\MessagingApplication.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe pNbYIr.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe pNbYIr.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe pNbYIr.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Time.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe pNbYIr.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE pNbYIr.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe pNbYIr.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe pNbYIr.exe File opened for modification C:\Program Files\Windows Defender\MSASCuiL.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe pNbYIr.exe File opened for modification C:\Program Files\7-Zip\7zG.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE pNbYIr.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe pNbYIr.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\elevation_service.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\XboxIdp.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxMail.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUMED0D.tmp\GoogleUpdateSetup.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxClickHandler.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe pNbYIr.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\86.0.4240.111\86.0.4240.111_chrome_installer.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE pNbYIr.exe File opened for modification C:\Program Files\Windows Defender\MpUXSrv.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Music.UI.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe pNbYIr.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe pNbYIr.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe pNbYIr.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe pNbYIr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe pNbYIr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe pNbYIr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE pNbYIr.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 944 wrote to memory of 3312 944 054960a260abc8459abaaa86facd46cd53742d10587f0091a276de63df99a43a.exe 75 PID 944 wrote to memory of 3312 944 054960a260abc8459abaaa86facd46cd53742d10587f0091a276de63df99a43a.exe 75 PID 944 wrote to memory of 3312 944 054960a260abc8459abaaa86facd46cd53742d10587f0091a276de63df99a43a.exe 75 PID 3312 wrote to memory of 3448 3312 pNbYIr.exe 81 PID 3312 wrote to memory of 3448 3312 pNbYIr.exe 81 PID 3312 wrote to memory of 3448 3312 pNbYIr.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\054960a260abc8459abaaa86facd46cd53742d10587f0091a276de63df99a43a.exe"C:\Users\Admin\AppData\Local\Temp\054960a260abc8459abaaa86facd46cd53742d10587f0091a276de63df99a43a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\pNbYIr.exeC:\Users\Admin\AppData\Local\Temp\pNbYIr.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\76743b35.bat" "3⤵PID:3448
-
-