Analysis
- max time kernel
150s - max time network
156s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
a26e49d0521137d7e07e96a2d015f9df.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a26e49d0521137d7e07e96a2d015f9df.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target a26e49d0521137d7e07e96a2d015f9df.exe
- Size 26KB
- Sample201117-k956eda5we
- SHA256 bebfbebaaeaa2c3c4d5e07eba23191dddeea256c4ccd6a7f0ba46941cb94f2b5
- MD5 4fde86b20dccbac38ff38c64acea9f30
- SHA1 faf99e1fc986b7e06baf8fcc1d619d47435e8ee7
- SHA512 3e4822b3cb753911e51e31632a2c5655f7c299ea26db2c1e7832703dbc6742ccc9873a23db738db4ba15f139b42fbbd41f2c163279af59dac7cb405e4c693b3e
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x000800000000068f-1.dat aspack_v212_v242 behavioral2/files/0x000800000000068f-2.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4876 JNEwqQ.exe - Drops file in Program Files directory 275 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.App.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE JNEwqQ.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxClickHandler.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Defender\MSASCuiL.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe JNEwqQ.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE JNEwqQ.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe JNEwqQ.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\setup.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE JNEwqQ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE JNEwqQ.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE JNEwqQ.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe JNEwqQ.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Mail\wab.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\MessagingApplication.exe JNEwqQ.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\notification_helper.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubWin32.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\XboxIdp.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe JNEwqQ.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\elevation_service.exe JNEwqQ.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe JNEwqQ.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Defender\MpUXSrv.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE JNEwqQ.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxMail.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe JNEwqQ.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\chrome_pwa_launcher.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE JNEwqQ.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe JNEwqQ.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe JNEwqQ.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxTsr.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe JNEwqQ.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe JNEwqQ.exe File opened for modification C:\Program Files\7-Zip\7zG.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{0C5D4CDF-5D9D-4019-A7CB-FAAD082B42AB}\86.0.4240.111_chrome_installer.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe JNEwqQ.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\OneConnect.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Time.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe JNEwqQ.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe JNEwqQ.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{0C5D4CDF-5D9D-4019-A7CB-FAAD082B42AB}\CR_8D4CF.tmp\setup.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUMCF92.tmp\GoogleUpdateSetup.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe JNEwqQ.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe JNEwqQ.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE JNEwqQ.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe JNEwqQ.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\86.0.4240.111\86.0.4240.111_chrome_installer.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteshare.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe JNEwqQ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe JNEwqQ.exe File opened for modification C:\Program Files\7-Zip\7z.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe JNEwqQ.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe JNEwqQ.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Music.UI.exe JNEwqQ.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe JNEwqQ.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe JNEwqQ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe JNEwqQ.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4700 wrote to memory of 4876 4700 a26e49d0521137d7e07e96a2d015f9df.exe 70 PID 4700 wrote to memory of 4876 4700 a26e49d0521137d7e07e96a2d015f9df.exe 70 PID 4700 wrote to memory of 4876 4700 a26e49d0521137d7e07e96a2d015f9df.exe 70 PID 4876 wrote to memory of 2996 4876 JNEwqQ.exe 79 PID 4876 wrote to memory of 2996 4876 JNEwqQ.exe 79 PID 4876 wrote to memory of 2996 4876 JNEwqQ.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\a26e49d0521137d7e07e96a2d015f9df.exe"C:\Users\Admin\AppData\Local\Temp\a26e49d0521137d7e07e96a2d015f9df.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\JNEwqQ.exeC:\Users\Admin\AppData\Local\Temp\JNEwqQ.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\391b0713.bat" "3⤵PID:2996
-
-