Analysis
-
max time kernel
152s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
05-12-2021 08:43
Static task
static1
Behavioral task
behavioral1
Sample
656a5cfc0f176a53f5da1635497c886e.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
-
Target
656a5cfc0f176a53f5da1635497c886e.exe
-
Size
1.9MB
-
MD5
656a5cfc0f176a53f5da1635497c886e
-
SHA1
1934b132e695562df0d36dd8df13dd2e47aadd35
-
SHA256
a7f49d965383c1d18343a3469f482820f41ea3d8a908d3e8cf43de0c20aa7442
-
SHA512
c21c16394350e3c0f1602ab128970af66b36a343f6644a60f3ded030f067003eb70f4dca12eb445ebd7131187b97d2ea97ecbab3d9df2978e0f07dc100d8d0bb
Score
10/10
Malware Config
Extracted
Path
C:\read-me.txt
Family
globeimposter
Ransom Note
All your files are Encrypted!
For data recovery needs decryptor.
How to buy decryptor:
----------------------------------------------------------------------------------------
| 1. Download Tor browser - https://www.torproject.org/ and install it.
| 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV
| 3. Create Ticket
----------------------------------------------------------------------------------------
Note! This link is available via Tor Browser only.
------------------------------------------------------------
or
http://helpqvrg3cc5mvb3.onion/
Your ID
���75 81 52 6D F8 87 37 7D AA 23 33 AC 8D 5E A6 19
13 44 7F ED B9 39 B5 D8 88 DD 6C 97 0A 4A 60 A8
2F E9 19 0D 04 62 C9 0A 43 80 91 EE 4F 1B 2B 6F
47 8E A2 45 54 86 F5 3C BB ED A7 14 47 01 37 F4
2A 11 F0 57 D0 44 06 E1 CD DA 84 AD F2 5F 6D 33
3C D9 16 63 FF 1F A1 AD 0B 3E 49 7D 77 45 6B 5A
4E 88 4C 36 0F 15 7D F2 6B 0F 82 5D 93 9A 07 FD
82 B1 83 50 F1 E8 97 9C 82 99 B2 EE 5A E7 23 F2
B1 F6 98 49 E5 C5 B2 31 B2 08 51 53 74 04 B1 F1
15 21 E9 BB 8A CE 69 C9 18 5C E6 9B BC 2B E9 86
53 CB 60 EE 6E 50 B5 EB 0A 2A 2C 58 53 49 D3 5A
30 DA ED 72 4C DD 14 3C 1B 75 90 22 7A 89 5F 94
13 42 A6 7F 8D E8 CB 92 BB 35 43 8D 56 22 F5 A1
B2 0C B2 56 E3 DD 00 65 31 D1 10 20 3F 9A CA EC
C7 59 29 5C 91 9D 9F 4B F9 03 9E B9 DA 84 42 70
30 ED 69 9F D0 7A 84 87 F6 70 85 0F AA 48 73 6F
URLs
http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV
http://helpqvrg3cc5mvb3.onion/
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ConfirmInstall.tif => C:\Users\Admin\Pictures\ConfirmInstall.tif.xls AddInProcess32.exe File renamed C:\Users\Admin\Pictures\DebugAssert.crw => C:\Users\Admin\Pictures\DebugAssert.crw.xls AddInProcess32.exe File renamed C:\Users\Admin\Pictures\GetTest.raw => C:\Users\Admin\Pictures\GetTest.raw.xls AddInProcess32.exe File renamed C:\Users\Admin\Pictures\InitializeConvert.tif => C:\Users\Admin\Pictures\InitializeConvert.tif.xls AddInProcess32.exe File renamed C:\Users\Admin\Pictures\InvokeStep.raw => C:\Users\Admin\Pictures\InvokeStep.raw.xls AddInProcess32.exe File renamed C:\Users\Admin\Pictures\PopRestart.raw => C:\Users\Admin\Pictures\PopRestart.raw.xls AddInProcess32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths 656a5cfc0f176a53f5da1635497c886e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions 656a5cfc0f176a53f5da1635497c886e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Resources\Themes\aero\Shell\D7B4D56CF88F2C9AD204F39DF651A704\svchost.exe = "0" 656a5cfc0f176a53f5da1635497c886e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\656a5cfc0f176a53f5da1635497c886e.exe = "0" 656a5cfc0f176a53f5da1635497c886e.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AEDD2F2952941E5B3EA29EEA9B369FA8 = "C:\\Windows\\Resources\\Themes\\aero\\Shell\\D7B4D56CF88F2C9AD204F39DF651A704\\svchost.exe" 656a5cfc0f176a53f5da1635497c886e.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce AddInProcess32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\AddInProcess32.exe" AddInProcess32.exe -
Drops desktop.ini file(s) 36 IoCs
description ioc Process File opened for modification C:\Users\Admin\Music\desktop.ini AddInProcess32.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Public\Music\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Admin\Searches\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini AddInProcess32.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Public\Downloads\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Public\Documents\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Public\Videos\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Admin\Videos\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini AddInProcess32.exe File opened for modification C:\Program Files\desktop.ini AddInProcess32.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini AddInProcess32.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI AddInProcess32.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Public\Desktop\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini AddInProcess32.exe File opened for modification C:\Program Files (x86)\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini AddInProcess32.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini AddInProcess32.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Public\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Public\Pictures\desktop.ini AddInProcess32.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Public\Libraries\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Admin\Links\desktop.ini AddInProcess32.exe File opened for modification C:\Users\Admin\Documents\desktop.ini AddInProcess32.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1684 set thread context of 1232 1684 656a5cfc0f176a53f5da1635497c886e.exe 35 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL022.XML AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01659_.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216540.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanMergeLetter.Dotx AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_alignleft.gif AddInProcess32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo AddInProcess32.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\read-me.txt AddInProcess32.exe File opened for modification C:\Program Files\Java\jre7\bin\nio.dll AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00555_.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00563_.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSRETRO.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00671_.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_SlateBlue.gif AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\TAB_OFF.GIF AddInProcess32.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\read-me.txt AddInProcess32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00687_.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151041.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf AddInProcess32.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Visualizer.zip AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BIZFORM.XML AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0235319.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01166_.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00546_.WMF AddInProcess32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESP98.POC AddInProcess32.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll AddInProcess32.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215076.WMF AddInProcess32.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll AddInProcess32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac AddInProcess32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\read-me.txt AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTIRMV.XML AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR27F.GIF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105332.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00641_.WMF AddInProcess32.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03668_.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00735_.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN075.XML AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21299_.GIF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188587.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239965.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_01.MID AddInProcess32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png AddInProcess32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati AddInProcess32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar AddInProcess32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar AddInProcess32.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libexport_plugin.dll AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImages.bmp AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00693_.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03425I.JPG AddInProcess32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_es.dll AddInProcess32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099149.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00152_.WMF AddInProcess32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\utilityfunctions.js AddInProcess32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXPTOOWS.DLL AddInProcess32.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Resources\Themes\aero\Shell\D7B4D56CF88F2C9AD204F39DF651A704\svchost.exe 656a5cfc0f176a53f5da1635497c886e.exe File opened for modification C:\Windows\Resources\Themes\aero\Shell\D7B4D56CF88F2C9AD204F39DF651A704\svchost.exe 656a5cfc0f176a53f5da1635497c886e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1228 powershell.exe 1472 powershell.exe 1928 powershell.exe 1684 656a5cfc0f176a53f5da1635497c886e.exe 1684 656a5cfc0f176a53f5da1635497c886e.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1232 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1684 656a5cfc0f176a53f5da1635497c886e.exe Token: SeDebugPrivilege 1228 powershell.exe Token: SeDebugPrivilege 1472 powershell.exe Token: SeDebugPrivilege 1928 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1684 wrote to memory of 1472 1684 656a5cfc0f176a53f5da1635497c886e.exe 28 PID 1684 wrote to memory of 1472 1684 656a5cfc0f176a53f5da1635497c886e.exe 28 PID 1684 wrote to memory of 1472 1684 656a5cfc0f176a53f5da1635497c886e.exe 28 PID 1684 wrote to memory of 1472 1684 656a5cfc0f176a53f5da1635497c886e.exe 28 PID 1684 wrote to memory of 1228 1684 656a5cfc0f176a53f5da1635497c886e.exe 30 PID 1684 wrote to memory of 1228 1684 656a5cfc0f176a53f5da1635497c886e.exe 30 PID 1684 wrote to memory of 1228 1684 656a5cfc0f176a53f5da1635497c886e.exe 30 PID 1684 wrote to memory of 1228 1684 656a5cfc0f176a53f5da1635497c886e.exe 30 PID 1684 wrote to memory of 1928 1684 656a5cfc0f176a53f5da1635497c886e.exe 32 PID 1684 wrote to memory of 1928 1684 656a5cfc0f176a53f5da1635497c886e.exe 32 PID 1684 wrote to memory of 1928 1684 656a5cfc0f176a53f5da1635497c886e.exe 32 PID 1684 wrote to memory of 1928 1684 656a5cfc0f176a53f5da1635497c886e.exe 32 PID 1684 wrote to memory of 1544 1684 656a5cfc0f176a53f5da1635497c886e.exe 34 PID 1684 wrote to memory of 1544 1684 656a5cfc0f176a53f5da1635497c886e.exe 34 PID 1684 wrote to memory of 1544 1684 656a5cfc0f176a53f5da1635497c886e.exe 34 PID 1684 wrote to memory of 1544 1684 656a5cfc0f176a53f5da1635497c886e.exe 34 PID 1684 wrote to memory of 1544 1684 656a5cfc0f176a53f5da1635497c886e.exe 34 PID 1684 wrote to memory of 1544 1684 656a5cfc0f176a53f5da1635497c886e.exe 34 PID 1684 wrote to memory of 1544 1684 656a5cfc0f176a53f5da1635497c886e.exe 34 PID 1684 wrote to memory of 1544 1684 656a5cfc0f176a53f5da1635497c886e.exe 34 PID 1684 wrote to memory of 1232 1684 656a5cfc0f176a53f5da1635497c886e.exe 35 PID 1684 wrote to memory of 1232 1684 656a5cfc0f176a53f5da1635497c886e.exe 35 PID 1684 wrote to memory of 1232 1684 656a5cfc0f176a53f5da1635497c886e.exe 35 PID 1684 wrote to memory of 1232 1684 656a5cfc0f176a53f5da1635497c886e.exe 35 PID 1684 wrote to memory of 1232 1684 656a5cfc0f176a53f5da1635497c886e.exe 35 PID 1684 wrote to memory of 1232 1684 656a5cfc0f176a53f5da1635497c886e.exe 35 PID 1684 wrote to memory of 1232 1684 656a5cfc0f176a53f5da1635497c886e.exe 35 PID 1684 wrote to memory of 1232 1684 656a5cfc0f176a53f5da1635497c886e.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\656a5cfc0f176a53f5da1635497c886e.exe"C:\Users\Admin\AppData\Local\Temp\656a5cfc0f176a53f5da1635497c886e.exe"1⤵
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\D7B4D56CF88F2C9AD204F39DF651A704\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\656a5cfc0f176a53f5da1635497c886e.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\D7B4D56CF88F2C9AD204F39DF651A704\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe2⤵PID:1544
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
PID:1232
-