Analysis
- max time kernel
71s - max time network
74s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:28
Static task
static1
Behavioral task
behavioral1
Sample
758fa8e944f1fc7a2fd3587d5e6e02699a9e2e8e7be43627c4ac5bee29b83a7f.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
758fa8e944f1fc7a2fd3587d5e6e02699a9e2e8e7be43627c4ac5bee29b83a7f.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 758fa8e944f1fc7a2fd3587d5e6e02699a9e2e8e7be43627c4ac5bee29b83a7f.exe
- Size 10.3MB
- Sample201109-tlsfjaxwhe
- SHA256 758fa8e944f1fc7a2fd3587d5e6e02699a9e2e8e7be43627c4ac5bee29b83a7f
- MD5 3a186abfc61455940e11045f60b55bf1
- SHA1 be94471cd5cb6cf93bec07587f79bf83678f40a9
- SHA512 828feaa01870b193c2f261470b019b25335efdec876352c6408b822f5043efe5c2dcd04a82b8bac78181074ea0d19c22aed1d0720406476df5345050c8b636a5
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x000200000001ab43-1.dat aspack_v212_v242 behavioral2/files/0x000200000001ab43-2.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1992 gjaXkc.exe - Drops file in Program Files directory 275 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe gjaXkc.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe gjaXkc.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe gjaXkc.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\86.0.4240.111\86.0.4240.111_chrome_installer.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteshare.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe gjaXkc.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe gjaXkc.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe gjaXkc.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe gjaXkc.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE gjaXkc.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE gjaXkc.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe gjaXkc.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxTsr.exe gjaXkc.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\notification_helper.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\OneConnect.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe gjaXkc.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe gjaXkc.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\elevation_service.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe gjaXkc.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe gjaXkc.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\MessagingApplication.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE gjaXkc.exe File opened for modification C:\Program Files\Windows Mail\wab.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\XboxIdp.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE gjaXkc.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe gjaXkc.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe gjaXkc.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE gjaXkc.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE gjaXkc.exe File opened for modification C:\Program Files\Windows Defender\MpUXSrv.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxClickHandler.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\86.0.4240.111_chrome_installer.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe gjaXkc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe gjaXkc.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe gjaXkc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE gjaXkc.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe gjaXkc.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe gjaXkc.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubWin32.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUMED0D.tmp\GoogleUpdateSetup.exe gjaXkc.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\setup.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Time.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE gjaXkc.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE gjaXkc.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe gjaXkc.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe gjaXkc.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE gjaXkc.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe gjaXkc.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxMail.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE gjaXkc.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe gjaXkc.exe File opened for modification C:\Program Files\Windows Defender\MSASCuiL.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Music.UI.exe gjaXkc.exe File opened for modification C:\Program Files\7-Zip\7z.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.App.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_2BD8F.tmp\setup.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe gjaXkc.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE gjaXkc.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe gjaXkc.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\chrome_pwa_launcher.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe gjaXkc.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe gjaXkc.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe gjaXkc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe gjaXkc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe gjaXkc.exe File opened for modification C:\Program Files\7-Zip\7zG.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE gjaXkc.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe gjaXkc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe gjaXkc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE gjaXkc.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4052 758fa8e944f1fc7a2fd3587d5e6e02699a9e2e8e7be43627c4ac5bee29b83a7f.exe 4052 758fa8e944f1fc7a2fd3587d5e6e02699a9e2e8e7be43627c4ac5bee29b83a7f.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4052 wrote to memory of 1992 4052 758fa8e944f1fc7a2fd3587d5e6e02699a9e2e8e7be43627c4ac5bee29b83a7f.exe 75 PID 4052 wrote to memory of 1992 4052 758fa8e944f1fc7a2fd3587d5e6e02699a9e2e8e7be43627c4ac5bee29b83a7f.exe 75 PID 4052 wrote to memory of 1992 4052 758fa8e944f1fc7a2fd3587d5e6e02699a9e2e8e7be43627c4ac5bee29b83a7f.exe 75 PID 1992 wrote to memory of 3744 1992 gjaXkc.exe 79 PID 1992 wrote to memory of 3744 1992 gjaXkc.exe 79 PID 1992 wrote to memory of 3744 1992 gjaXkc.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\758fa8e944f1fc7a2fd3587d5e6e02699a9e2e8e7be43627c4ac5bee29b83a7f.exe"C:\Users\Admin\AppData\Local\Temp\758fa8e944f1fc7a2fd3587d5e6e02699a9e2e8e7be43627c4ac5bee29b83a7f.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\gjaXkc.exeC:\Users\Admin\AppData\Local\Temp\gjaXkc.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\31346170.bat" "3⤵PID:3744
-
-