Analysis
- max time kernel
152s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
06/01/2022, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
2f121145ea11b36f9ade0cb8f319e40a.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2f121145ea11b36f9ade0cb8f319e40a.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target 2f121145ea11b36f9ade0cb8f319e40a.exe
- Size 360KB
- Sample220106-n7fp8abca6
- SHA256 59e0ab333060b4e510db5d36d87f0fe267ab66b0881955649b06d91d6dd2d486
- MD5 2f121145ea11b36f9ade0cb8f319e40a
- SHA1 d68049989ce98f71f6a562e439f6b6f0a165f003
- SHA512 9211a74cfa23c70c6ace8bd168ecbe1bb4a06d2e03b5adff5546115137b6ce849d3e41337581123d48e5082319f507d8f2d274621317fada182530e4a0abb6c7
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\read-me.txt
-
globeimposter
Ransom Note
- All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ���37 1C 0E 7A 73 9E A2 7C 64 9B B5 DC DA 25 37 08 A8 37 79 00 D8 10 42 49 15 A8 59 89 B3 D3 A0 BA EB 89 88 F3 48 67 F4 9D 6D E1 F7 CF 30 35 C0 95 C4 31 F9 D1 36 73 F9 62 EB 6B 30 F2 53 01 EC 33 24 A1 C2 E9 BF E8 6F A3 EF EE F3 3C 98 0F AC F0 96 F2 D4 49 54 9C 9A 1B 6E FE B7 5C EB F5 BD D3 5F 03 C7 5A 48 95 18 32 54 8D 44 18 03 A9 29 F0 25 F8 A9 5D A6 C6 F5 8C CA 0F 1B A4 82 4D 0F B5 A4 A3 59 06 95 79 AA 12 03 A5 6E 09 1E 0A 0A 0A DF BE 87 8A 87 8F F0 05 70 15 83 6B 43 87 FF 95 E3 AA 74 F1 A6 55 AA 95 99 53 CE 71 4F 14 75 D1 85 1A FF 8B F7 21 65 58 3C 28 58 4F 86 46 DF 3F C5 A3 99 CC 9C FB B6 DD 5B BA 20 93 59 6A 0D C4 44 BA FF 82 6C 33 FB 38 22 D1 3E 93 E6 90 BB AF 33 42 07 19 08 E7 12 3D 5E 48 AE 34 F2 EE 10 A8 E8 FA 45 AA 5A 0B 9A 66 8C 2F 88 F2 DD 20 F9 2A
URLs
-
http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV
-
http://helpqvrg3cc5mvb3.onion/
Signatures
- GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
- Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\DisableOptimize.tif => C:\Users\Admin\Pictures\DisableOptimize.tif.xls 2f121145ea11b36f9ade0cb8f319e40a.exe File renamed C:\Users\Admin\Pictures\SyncDisable.crw => C:\Users\Admin\Pictures\SyncDisable.crw.xls 2f121145ea11b36f9ade0cb8f319e40a.exe File renamed C:\Users\Admin\Pictures\UnprotectComplete.png => C:\Users\Admin\Pictures\UnprotectComplete.png.xls 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Pictures\UnregisterGrant.tiff 2f121145ea11b36f9ade0cb8f319e40a.exe File renamed C:\Users\Admin\Pictures\UnregisterGrant.tiff => C:\Users\Admin\Pictures\UnregisterGrant.tiff.xls 2f121145ea11b36f9ade0cb8f319e40a.exe File renamed C:\Users\Admin\Pictures\ConvertFromAssert.tif => C:\Users\Admin\Pictures\ConvertFromAssert.tif.xls 2f121145ea11b36f9ade0cb8f319e40a.exe File renamed C:\Users\Admin\Pictures\SkipComplete.raw => C:\Users\Admin\Pictures\SkipComplete.raw.xls 2f121145ea11b36f9ade0cb8f319e40a.exe File renamed C:\Users\Admin\Pictures\StartResize.png => C:\Users\Admin\Pictures\StartResize.png.xls 2f121145ea11b36f9ade0cb8f319e40a.exe File renamed C:\Users\Admin\Pictures\SwitchGroup.png => C:\Users\Admin\Pictures\SwitchGroup.png.xls 2f121145ea11b36f9ade0cb8f319e40a.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 26 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Public\Music\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Public\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\desktop.ini 2f121145ea11b36f9ade0cb8f319e40a.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2444 set thread context of 2812 2444 2f121145ea11b36f9ade0cb8f319e40a.exe 70 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reminders_18.svg 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBarTasks.dll 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\saext.dll 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxAccountsSplashLogo.scale-180.png 2f121145ea11b36f9ade0cb8f319e40a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\read-me.txt 2f121145ea11b36f9ade0cb8f319e40a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\read-me.txt 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\main-selector.css 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.Xaml.Toolkit\Assets\GameOverPopUp_D.wav 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\ui-strings.js 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-black\Square310x150Logo.scale-100.png 2f121145ea11b36f9ade0cb8f319e40a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\read-me.txt 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\comment.svg 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-300.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-white_scale-200.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\resources.pri 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCache-Dark.scale-240.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\crying.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_CatEye.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-200.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\GenericMailMediumTile.scale-125.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeSmallTile.scale-150.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-200.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\vo_16x11.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreSmallTile.scale-200.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1949_32x32x32.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-white\Square44x44Logo.targetsize-48_altform-unplated.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe\Assets\Office\Smooth.scale-180.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailWideTile.scale-200.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\pe_16x11.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\ui-strings.js 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\8196_20x20x32.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\EmbossBitmaps\Oval.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\appstore.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Office Word 2003 Look.dotx 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2818_20x20x32.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-256.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-96.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsMedTile.scale-100.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\models\en-US.Calendar.model 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-125_contrast-black.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main-selector.css 2f121145ea11b36f9ade0cb8f319e40a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\read-me.txt 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-32_altform-unplated.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\re_16x11.png 2f121145ea11b36f9ade0cb8f319e40a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\read-me.txt 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-fullcolor.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-100.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\188.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL119.XML 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\main-selector.css 2f121145ea11b36f9ade0cb8f319e40a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\read-me.txt 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Lumia.ViewerPlugin\Assets\IconOpenInCinemagraph.scale-200.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\shape_wedge.png 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c\resources.pri 2f121145ea11b36f9ade0cb8f319e40a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\ui-strings.js 2f121145ea11b36f9ade0cb8f319e40a.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3692 schtasks.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2444 wrote to memory of 3692 2444 2f121145ea11b36f9ade0cb8f319e40a.exe 68 PID 2444 wrote to memory of 3692 2444 2f121145ea11b36f9ade0cb8f319e40a.exe 68 PID 2444 wrote to memory of 3692 2444 2f121145ea11b36f9ade0cb8f319e40a.exe 68 PID 2444 wrote to memory of 2812 2444 2f121145ea11b36f9ade0cb8f319e40a.exe 70 PID 2444 wrote to memory of 2812 2444 2f121145ea11b36f9ade0cb8f319e40a.exe 70 PID 2444 wrote to memory of 2812 2444 2f121145ea11b36f9ade0cb8f319e40a.exe 70 PID 2444 wrote to memory of 2812 2444 2f121145ea11b36f9ade0cb8f319e40a.exe 70 PID 2444 wrote to memory of 2812 2444 2f121145ea11b36f9ade0cb8f319e40a.exe 70 PID 2444 wrote to memory of 2812 2444 2f121145ea11b36f9ade0cb8f319e40a.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f121145ea11b36f9ade0cb8f319e40a.exe"C:\Users\Admin\AppData\Local\Temp\2f121145ea11b36f9ade0cb8f319e40a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jVYbanglCI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp10F4.tmp"2⤵
- Creates scheduled task(s)
PID:3692
-
-
C:\Users\Admin\AppData\Local\Temp\2f121145ea11b36f9ade0cb8f319e40a.exe"{path}"2⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2812
-