Analysis
-
max time kernel
35s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
09-05-2021 10:26
Static task
static1
Behavioral task
behavioral1
Sample
123.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
123.exe
Resource
win10v20210410
0 signatures
0 seconds
General
-
Target
123.exe
-
Size
89KB
-
MD5
3822d0484ec81d615a0913c398ad1f83
-
SHA1
b7bd3e90724189c7316b82a70ce85e0a91855089
-
SHA256
27a1f89ce5a37815010c8411dddec85d5d66e81a957ad722fbd2dc64f99651c8
-
SHA512
d103abe81ef9bba19a3f21c8a2742b6a6dad2d147bb440e81b1f17b1d0f67fc3dfa4c33c84ec8b7ca1b107fbd91535ee588d29bded615cff58685eb611665fe8
Score
10/10
Malware Config
Signatures
-
InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\UnpublishInstall.png.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Users\Admin\Pictures\WaitProtect.crw.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Users\Admin\Pictures\ConvertFromGroup.raw.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Users\Admin\Pictures\NewMount.raw.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Users\Admin\Pictures\OptimizeUse.tiff.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Users\Admin\Pictures\StepSet.raw.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tl.gif.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\TrackedSend.aapp.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\inline-error-1x.png.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\close.svg.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Close.png.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-default.svg.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-right.png.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\acrobat_parcel_generic_32.svg.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\sat_logo_2x.png.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\share_icons.png.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\EScript.api.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\selector.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons_2x.png.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\cs-cz\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libcef.dll.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_checkbox_partialselected-default_18.svg.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\en_get.svg.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-press.svg.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Scan_visual.svg.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close-2.svg.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ReadOutLoud.api.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons.png.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_100_percent.pak.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_newfolder_18.svg.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\AppStore_icon.svg.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dummy.dic.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_comment_18.svg.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_47.dll.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\ui-strings.js.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Close2x.png.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close_h.png.50702BC5CF7877055EEC0C3D9008EE6DF28B181B11D3D48F28D747747AC8EE5E 123.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 123.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 123.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3944 123.exe