Analysis
- max time kernel
67s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:24
Static task
static1
Behavioral task
behavioral1
Sample
e11ef3018a3163e4f03ec0a5ec6f300817c5f44cc6ecf86dc2d0aeb4a7327835.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e11ef3018a3163e4f03ec0a5ec6f300817c5f44cc6ecf86dc2d0aeb4a7327835.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target e11ef3018a3163e4f03ec0a5ec6f300817c5f44cc6ecf86dc2d0aeb4a7327835.exe
- Size 10.3MB
- Sample201109-q2e2pgwb2x
- SHA256 e11ef3018a3163e4f03ec0a5ec6f300817c5f44cc6ecf86dc2d0aeb4a7327835
- MD5 3b6482c199b9581ad3d0da6df9edff66
- SHA1 dc91cbe5d19b44e7626f82cfb85eb9c61504ed61
- SHA512 d7288a73182c46bb5066d3fcadd16cc069c748bc81f9ede910ae9b5f883013c40b186dc5b3ab67082a4328eeceabb0124fe4491455288b70d3618f9ff71948f5
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x000200000001ab73-1.dat aspack_v212_v242 behavioral2/files/0x000200000001ab73-2.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1396 KpKRa.exe - Drops file in Program Files directory 276 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe KpKRa.exe File opened for modification C:\Program Files\Windows Defender\MSASCuiL.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe KpKRa.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe KpKRa.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\elevation_service.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\86.0.4240.111\86.0.4240.111_chrome_installer.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE KpKRa.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe KpKRa.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe KpKRa.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.App.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE KpKRa.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe KpKRa.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe KpKRa.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE KpKRa.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe KpKRa.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe KpKRa.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe KpKRa.exe File opened for modification C:\Program Files\7-Zip\7zG.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe KpKRa.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe KpKRa.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe KpKRa.exe File opened for modification C:\Program Files\7-Zip\7z.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE KpKRa.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Music.UI.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\86.0.4240.111_chrome_installer.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE KpKRa.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe KpKRa.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\OneConnect.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE KpKRa.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteshare.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe KpKRa.exe File opened for modification C:\Program Files\Windows Mail\wab.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe KpKRa.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\MessagingApplication.exe KpKRa.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\notification_helper.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxTsr.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe KpKRa.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\setup.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE KpKRa.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE KpKRa.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_2BD8F.tmp\setup.exe KpKRa.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe KpKRa.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Time.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe KpKRa.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe KpKRa.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubWin32.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE KpKRa.exe File opened for modification C:\Program Files\Windows Defender\MpUXSrv.exe KpKRa.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE KpKRa.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe KpKRa.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxClickHandler.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe KpKRa.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe KpKRa.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe KpKRa.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe KpKRa.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe KpKRa.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxMail.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\XboxIdp.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE KpKRa.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe KpKRa.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE KpKRa.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe KpKRa.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe KpKRa.exe File opened for modification C:\Program Files\UpdateUninstall.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe KpKRa.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe KpKRa.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe KpKRa.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\chrome_pwa_launcher.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe KpKRa.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUMED0D.tmp\GoogleUpdateSetup.exe KpKRa.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe KpKRa.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe KpKRa.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE KpKRa.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 812 e11ef3018a3163e4f03ec0a5ec6f300817c5f44cc6ecf86dc2d0aeb4a7327835.exe 812 e11ef3018a3163e4f03ec0a5ec6f300817c5f44cc6ecf86dc2d0aeb4a7327835.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 812 wrote to memory of 1396 812 e11ef3018a3163e4f03ec0a5ec6f300817c5f44cc6ecf86dc2d0aeb4a7327835.exe 75 PID 812 wrote to memory of 1396 812 e11ef3018a3163e4f03ec0a5ec6f300817c5f44cc6ecf86dc2d0aeb4a7327835.exe 75 PID 812 wrote to memory of 1396 812 e11ef3018a3163e4f03ec0a5ec6f300817c5f44cc6ecf86dc2d0aeb4a7327835.exe 75 PID 1396 wrote to memory of 3856 1396 KpKRa.exe 79 PID 1396 wrote to memory of 3856 1396 KpKRa.exe 79 PID 1396 wrote to memory of 3856 1396 KpKRa.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\e11ef3018a3163e4f03ec0a5ec6f300817c5f44cc6ecf86dc2d0aeb4a7327835.exe"C:\Users\Admin\AppData\Local\Temp\e11ef3018a3163e4f03ec0a5ec6f300817c5f44cc6ecf86dc2d0aeb4a7327835.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\KpKRa.exeC:\Users\Admin\AppData\Local\Temp\KpKRa.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\139378e4.bat" "3⤵PID:3856
-
-