Analysis
- max time kernel
26s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/11/2020, 10:58
Static task
static1
Behavioral task
behavioral1
Sample
68d9b1b79eac821bd61cfea1a528b5a26fc371be1e24bf71ec424fddb63e5c92.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
68d9b1b79eac821bd61cfea1a528b5a26fc371be1e24bf71ec424fddb63e5c92.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 68d9b1b79eac821bd61cfea1a528b5a26fc371be1e24bf71ec424fddb63e5c92.exe
- Size 6.9MB
- Sample201111-3qv444w7tj
- SHA256 68d9b1b79eac821bd61cfea1a528b5a26fc371be1e24bf71ec424fddb63e5c92
- MD5 22c8c133d963b526b0fb8db11dc08092
- SHA1 1745b445ecfa00a0acf935d5a29edf75ee327acb
- SHA512 0c3a9acf60dcf75ae8e424f6aa9f816855089487522cc6703372c4bfaa1c15e2c20230aef86c41433538c95ddcfe9133272a20a6c2072a5f7e5ec2d462b28d21
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x0008000000000687-2.dat aspack_v212_v242 behavioral2/files/0x0008000000000687-1.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2272 zstIfGj.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1056 68d9b1b79eac821bd61cfea1a528b5a26fc371be1e24bf71ec424fddb63e5c92.exe - Drops file in Program Files directory 275 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE zstIfGj.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe zstIfGj.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE zstIfGj.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe zstIfGj.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe zstIfGj.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE zstIfGj.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE zstIfGj.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\MessagingApplication.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE zstIfGj.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE zstIfGj.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe zstIfGj.exe File opened for modification C:\Program Files\Windows Defender\MSASCuiL.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\OneConnect.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe zstIfGj.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubWin32.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteshare.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxMail.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE zstIfGj.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe zstIfGj.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\elevation_service.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe zstIfGj.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe zstIfGj.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe zstIfGj.exe File opened for modification C:\Program Files\Windows Mail\wab.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe zstIfGj.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe zstIfGj.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe zstIfGj.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUMED0D.tmp\GoogleUpdateSetup.exe zstIfGj.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\notification_helper.exe zstIfGj.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe zstIfGj.exe File opened for modification C:\Program Files\7-Zip\7z.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Music.UI.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE zstIfGj.exe File opened for modification C:\Program Files\Windows Defender\MpUXSrv.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxTsr.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxClickHandler.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe zstIfGj.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\setup.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE zstIfGj.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe zstIfGj.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\XboxIdp.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe zstIfGj.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe zstIfGj.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe zstIfGj.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe zstIfGj.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\86.0.4240.111\86.0.4240.111_chrome_installer.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe zstIfGj.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\86.0.4240.111_chrome_installer.exe zstIfGj.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\chrome_pwa_launcher.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE zstIfGj.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe zstIfGj.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe zstIfGj.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_2BD8F.tmp\setup.exe zstIfGj.exe File opened for modification C:\Program Files\7-Zip\7zG.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE zstIfGj.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe zstIfGj.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Time.exe zstIfGj.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe zstIfGj.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE zstIfGj.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe zstIfGj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.App.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe zstIfGj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE zstIfGj.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe zstIfGj.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe zstIfGj.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe zstIfGj.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe zstIfGj.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1056 wrote to memory of 2272 1056 68d9b1b79eac821bd61cfea1a528b5a26fc371be1e24bf71ec424fddb63e5c92.exe 75 PID 1056 wrote to memory of 2272 1056 68d9b1b79eac821bd61cfea1a528b5a26fc371be1e24bf71ec424fddb63e5c92.exe 75 PID 1056 wrote to memory of 2272 1056 68d9b1b79eac821bd61cfea1a528b5a26fc371be1e24bf71ec424fddb63e5c92.exe 75 PID 2272 wrote to memory of 3324 2272 zstIfGj.exe 80 PID 2272 wrote to memory of 3324 2272 zstIfGj.exe 80 PID 2272 wrote to memory of 3324 2272 zstIfGj.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\68d9b1b79eac821bd61cfea1a528b5a26fc371be1e24bf71ec424fddb63e5c92.exe"C:\Users\Admin\AppData\Local\Temp\68d9b1b79eac821bd61cfea1a528b5a26fc371be1e24bf71ec424fddb63e5c92.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\zstIfGj.exeC:\Users\Admin\AppData\Local\Temp\zstIfGj.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7f140104.bat" "3⤵PID:3324
-
-