Analysis
-
max time kernel
134s -
max time network
140s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
23-11-2021 14:19
Static task
static1
Behavioral task
behavioral1
Sample
27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe
-
Size
402KB
-
MD5
b46dcf39b56fe9f129fd78bb70f39b2f
-
SHA1
ffb271557d40717c39b71c99b9d53c9eaea760c1
-
SHA256
27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4
-
SHA512
e3e8d41f32e9dac4f2fce7ebcb7ce0d5cb382b773c14a07724f4a1d95c49cc0728423f0221b77b49e0f073cfe4bea5b1f453cd0967c0d2699b2a942c30e1f19e
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\GET_YOUR_FILES_BACK.txt
Family
avoslocker
Ransom Note
Attention!
Your files have been encrypted using AES-256.
We highly suggest not shutting down your computer in case encryption process is not finished, as your files may get corrupted.
In order to decrypt your files, you must pay for the decryption key & application.
You may do so by visiting us at http://avos2fuj6olp6x36.onion.
This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/
Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website.
Hurry up, as the price may increase in the following days. If you fail to respond in a swift manner, we will leak your files in our press release/blog website accessible at http://avos53nnmi4u6amh.onion/
Message from agent: wqe
Your ID: f185fddd42a4b6b71d450e4cd7f961fc0d0359b66942fd95833cde18d44c5a2d
URLs
http://avos2fuj6olp6x36.onion
http://avos53nnmi4u6amh.onion/
Signatures
-
Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ConnectDeny.tif => C:\Users\Admin\Pictures\ConnectDeny.tif.avos 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe File renamed C:\Users\Admin\Pictures\RegisterUnblock.png => C:\Users\Admin\Pictures\RegisterUnblock.png.avos 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe File renamed C:\Users\Admin\Pictures\ResolveSync.png => C:\Users\Admin\Pictures\ResolveSync.png.avos 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-wal OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-shm OfficeClickToRun.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t|1634514746" OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,941 10,1329 15,941 15,941 6,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935} OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceId = "001840053DBD191D" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\001840053DBD191D = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000be5702db2abf3e40a6d5e01f6819a2f500000000020000000000106600000001000020000000d077d6a995ec2ddc328988a740d0c040635178e48de6b94fb16a81e66ca528e8000000000e80000000020000200000009e494bb06f81689f2ea67a305a8859c1c8881a6c06fa27962db5a367603d0a3d80000000a10b6a5a65b4f6be71114b8556d6f41140e83ae82a3fbf569a0be148a90995028b035a13726777e8728ec76fe41a0bf7bb8d62f2af0999c705d06c6ca54fe63f1c4d592a66e774a683611354853b937575e52549e42f631951ce6f79037a61144e7c01bfbd176fa4be0bec55622fbc3b764458b69d963ddb86b68483885c90d94000000016a60aef773e4f37755738ccd5d3d12f29592f0be28f45a16c5daf53b10ca989ba7065b392b1ba0689541c47929e42f9786cfd00d81c93a21b28a31e6a5df1cb OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1634428408" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile\MsaDevice = "t=GwAWAbuEBAAUTtlZ6S5DAUSlRrmXzKeUMjH15hsOZgAAEM7/Hnh/kWM8wF2lThETH5PgAJCXg98o3e4Pfvqwnxtf14nexSom2eRktEeSIoxvYGm/EkgkOeLb3Z+JhceAC59O3TpZGxbXgZkXkZSb1OmL/rLm1NWSTm8ujUu0RIqRFQ06cjIhFEglq96hOrfkFrlEUfqbBw8XuxPWm7/ac2eL3ng6HaufNLXl0miGb94G2H6JWI8S3401Pqipne5OhlQocmCZGUwMp5QgWoXzAOGrw5NZBZHjJ8Pdr3YE02aWqbggiCjde0hqBDm8V7RogH4GX8DqZyrsLJrYKCrmKaHMQaohxBbV0CXy5qn+9jlfC0bDGwE=&p=" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000be5702db2abf3e40a6d5e01f6819a2f500000000020000000000106600000001000020000000f7714763a52420542caacf8e0cd6be148b37fd5a131b9bf2041a085fe9b38126000000000e80000000020000200000001dedf000744f68cc7ced001b41d5f6bd8cd83dd9b59adf575db7c4b88db37828f003000013957e1710ed26a41995e10180942dd73b28458b7035355a6db5d02b5cc493adaa5d2c64bb5ef6b24bd92510d8c2d4f0347d553c2b0c71a6cb0e5eb0613209fa04dd8a469dd867298ebbcc80f832e801be0514192254b537f1ec2f032f06475f7176b4ba5c7043a5987449df5240e3a42b3fc362459d0413002e17d136ec76438e4568f5a76494ce547674df6f92b1d40fccc4a1e83ca132484c7ec0e2275c84229e6dd1282c8d2a5efd7ddcaa4502dde96d119432630b9ea8dbcd27935b77a96df80c6c9247e643536272f659f33eae057d9dd1f92820a71d001aefde59bf65bde3e985911a90e51e6d5a8ab8a68e093103501801b10040a6e203c13e844cc310af2f33379097d92728e49d89175cc823828b597500a84e44306e13c37372a7c6f50cd024caa24e1cbaba62b5c6fbc103f10dfaa3df20bc078f21f7ea9622df0371e1ab7d006b4ac3e0acf76ac43506bd3334f563e7422617dc84dcc8a487ae3733a0fb45593efe0c028ce2cde7ec67f33ed74f493846afaf44c34d35a8dd0993c0af1302becb2d200c99ed2a501e5c80cd9d6a9293aac836b3b252b21e030b2c4097019a52771f121d3339c8ba5366e8dfd4e50437b28db7b2cdfa759059afb4ff7f79dd8916fe64237c1eafb84f8325693840ca387044cf302791a64a155126619afa1c803f9d273208fe2ed2df1783e0c88e093db21285a892349edd1fef1c7e1dc804c171ec036cd1c52423c762d28b712995124e3a7611c89db52ce120df539ca2c2cc30bc447a379f29fb9cdee1862c45888f234ac114faf0aa077235783e602606663b13e296f0667bd7ae89b10fac746572cf9cf6394191e85834cf355ae7220ff24ec4bbdbd12ad912f1468b597e397a5b54c9c633fdbcf95cb08cf8716b95d48fb8846569fba69c4e9744b63aa4a5f56b7733e718097b8f9593592378edee18ae860931f178565c0464c8cbd51e14b5438899ae17fc68ad56ef59dbc6f8738a3c73518bd6c7ecf2140f89fe3032c8d3f492cb15fb0b10c8c550f3bb1dc63c0ccf3776d8693ae7bd0ead3e433767aba1db6017d257552f8eee331702a6fab99f508aeb307e31630d1fc170030f82be80e488a8600afeb7b80b77a4c264c3ab0e0becaa063903081a331740ba5e95ee17e55df399392f2495db197ddc1b2d777d9bc6ce28807015984b4810ddcb0ef0d4fa94a6ca315fe742f39585ed26e13cbb572eeebe09fa4b63d783c3db6dd550352b1ebcbf11315c17615726a7be68d2553b480bea5b6792e0c1f8d8c94fe4ca282e642f5ac455da26ba1f14021762c38705c9852f9dc3b76394332c450be4760b714b33f3ce11ce499289b82715d0b1a749eed09da20e2d4da25fa271d46ac6d03993daac707c13bdbfa1b4607e508b4f32b088ee6b833393737fa6400000002041f864f60d57fa5e497af1fe0174697f73f74c5aa1e8de16ffc2069b30a0b02ad6dc8368eecffdc82430e29ae65203104a94c431f602596f2e2fc3c030a223 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\ApplicationFlags = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" OfficeClickToRun.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe 2716 27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1948 OfficeClickToRun.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\27cd3e759ec4858adaea63050ad1fc22e4850c1e157d88c0943c2589fa39b5a4.bin.sample.exe"1⤵
- Modifies extensions of user files
- Suspicious behavior: EnumeratesProcesses
PID:2716
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1948