Analysis
-
max time kernel
124s -
max time network
126s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
20-01-2021 14:06
Static task
static1
Behavioral task
behavioral1
Sample
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe
Resource
win10v20201028
General
-
Target
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe
-
Size
191KB
-
MD5
20f0c736a966142de88dee06a2e4a5b1
-
SHA1
afb2fe6b541069259b0fd9be82d62594a361afb0
-
SHA256
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3
-
SHA512
a012898e9e8cc6789cbaea7a36f54140f1b70c45b8874f2f5504ea3971494d5856f7f54aaa00dc37a3746362d85b54c665bc485f0e7d491ec99e9155950c7e43
Malware Config
Extracted
C:\readme.txt
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.best
Signatures
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exedescription ioc process File renamed C:\Users\Admin\Pictures\StopFind.raw => C:\Users\Admin\Pictures\StopFind.raw.KKBKR 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File renamed C:\Users\Admin\Pictures\UnblockConnect.tif => C:\Users\Admin\Pictures\UnblockConnect.tif.KKBKR 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File renamed C:\Users\Admin\Pictures\UnpublishSet.crw => C:\Users\Admin\Pictures\UnpublishSet.crw.KKBKR 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File renamed C:\Users\Admin\Pictures\LimitDebug.tif => C:\Users\Admin\Pictures\LimitDebug.tif.KKBKR 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe -
Drops startup file 1 IoCs
Processes:
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 39 IoCs
Processes:
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exedescription ioc process File opened for modification C:\Users\Public\Downloads\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification \??\UNC\10.10.0.30\C$\Users\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification \??\UNC\10.10.0.30\C$\Program Files\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Links\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Videos\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification \??\UNC\10.10.0.30\C$\Program Files (x86)\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification \??\UNC\10.10.0.30\C$\Users\Public\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification \??\UNC\10.10.0.17\C$\Program Files\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification \??\UNC\10.10.0.17\C$\Users\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Music\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Documents\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification \??\UNC\10.10.0.17\C$\Program Files (x86)\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Music\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe -
Drops file in Program Files directory 9237 IoCs
Processes:
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info2x.png 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\PREVIEW.GIF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\THMBNAIL.PNG 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\ui-strings.js 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.actionProvider.exsd 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\ui-strings.js 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\NETWORK.INF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pl-pl\ui-strings.js 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-fr\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\THMBNAIL.PNG 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons.png 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_field_grabber.png 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview_selected-hover.svg 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\ui-strings.js 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\default.vlt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\ui-strings.js 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_2BD8F.tmp 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-focus.svg 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\ui-strings.js 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaSansDemiBold.ttf 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBOB6.CHM 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\nb.pak 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT632.CNV 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons_retina.png 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-tw\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\ui-strings.js 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe -
Modifies Control Panel 1 IoCs
Processes:
ShellExperienceHost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors ShellExperienceHost.exe -
Suspicious behavior: EnumeratesProcesses 188 IoCs
Processes:
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exepid process 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 736 vssvc.exe Token: SeRestorePrivilege 736 vssvc.exe Token: SeAuditPrivilege 736 vssvc.exe Token: SeIncreaseQuotaPrivilege 4068 WMIC.exe Token: SeSecurityPrivilege 4068 WMIC.exe Token: SeTakeOwnershipPrivilege 4068 WMIC.exe Token: SeLoadDriverPrivilege 4068 WMIC.exe Token: SeSystemProfilePrivilege 4068 WMIC.exe Token: SeSystemtimePrivilege 4068 WMIC.exe Token: SeProfSingleProcessPrivilege 4068 WMIC.exe Token: SeIncBasePriorityPrivilege 4068 WMIC.exe Token: SeCreatePagefilePrivilege 4068 WMIC.exe Token: SeBackupPrivilege 4068 WMIC.exe Token: SeRestorePrivilege 4068 WMIC.exe Token: SeShutdownPrivilege 4068 WMIC.exe Token: SeDebugPrivilege 4068 WMIC.exe Token: SeSystemEnvironmentPrivilege 4068 WMIC.exe Token: SeRemoteShutdownPrivilege 4068 WMIC.exe Token: SeUndockPrivilege 4068 WMIC.exe Token: SeManageVolumePrivilege 4068 WMIC.exe Token: 33 4068 WMIC.exe Token: 34 4068 WMIC.exe Token: 35 4068 WMIC.exe Token: 36 4068 WMIC.exe Token: SeIncreaseQuotaPrivilege 4068 WMIC.exe Token: SeSecurityPrivilege 4068 WMIC.exe Token: SeTakeOwnershipPrivilege 4068 WMIC.exe Token: SeLoadDriverPrivilege 4068 WMIC.exe Token: SeSystemProfilePrivilege 4068 WMIC.exe Token: SeSystemtimePrivilege 4068 WMIC.exe Token: SeProfSingleProcessPrivilege 4068 WMIC.exe Token: SeIncBasePriorityPrivilege 4068 WMIC.exe Token: SeCreatePagefilePrivilege 4068 WMIC.exe Token: SeBackupPrivilege 4068 WMIC.exe Token: SeRestorePrivilege 4068 WMIC.exe Token: SeShutdownPrivilege 4068 WMIC.exe Token: SeDebugPrivilege 4068 WMIC.exe Token: SeSystemEnvironmentPrivilege 4068 WMIC.exe Token: SeRemoteShutdownPrivilege 4068 WMIC.exe Token: SeUndockPrivilege 4068 WMIC.exe Token: SeManageVolumePrivilege 4068 WMIC.exe Token: 33 4068 WMIC.exe Token: 34 4068 WMIC.exe Token: 35 4068 WMIC.exe Token: 36 4068 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ShellExperienceHost.exepid process 3728 ShellExperienceHost.exe 3728 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.execmd.exedescription pid process target process PID 580 wrote to memory of 3296 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 580 wrote to memory of 3296 580 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 3296 wrote to memory of 4068 3296 cmd.exe WMIC.exe PID 3296 wrote to memory of 4068 3296 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe"C:\Users\Admin\AppData\Local\Temp\198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DAF7675F-A20E-414A-A7AE-F4A660F7C394}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DAF7675F-A20E-414A-A7AE-F4A660F7C394}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
- Drops file in Windows directory