Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
168s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
01/02/2022, 06:10
Static task
static1
Behavioral task
behavioral1
Sample
60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe
Resource
win10v2004-en-20220112
General
-
Target
60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe
-
Size
53KB
-
MD5
a0e495354a1e55ace1c808bf7b9539a2
-
SHA1
72bbef2b0f97567844c33ec22b1b3470057e2546
-
SHA256
60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12
-
SHA512
d5beb7baaa34249c2f6b6ce87263b9008616241de05fac6626ca275488a3c0e239f9f1c74144d3199a9ade02a15bb9103ebbb3ba741ac1ad09177302b3fec308
Malware Config
Extracted
C:\how_to_back_files.html
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Sets service image path in registry 2 TTPs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe" 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe -
Drops desktop.ini file(s) 26 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Public\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Public\Videos\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Public\Music\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\Music\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\Links\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Public\Documents\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_hr.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pe.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\ui-strings.js 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\help.svg 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\AddressBook.png 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_bn.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_zh-TW.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icucnv40.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-fr\ui-strings.js 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_mr.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\ui-strings.js 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\cs-cz\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\desktop.ini 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-Bold.otf 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\ui-strings.js 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\da-dk\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\main.css 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_fr.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\ui-strings.js 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\ui-strings.js 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateOnDemand.exe 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_sr.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_th.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Bold.otf 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\de-de\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\ui-strings.js 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_en.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ro-ro\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\CompleteCheckmark2x.png 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Confirmation2x.png 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Info.png 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\checkmark.png 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Info2x.png 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\ui-strings.js 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_no.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeLinguistic.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\uk-ua\ui-strings.js 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\ui-strings.js 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_da.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\SY______.PFM 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sv-se\ui-strings.js 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\how_to_back_files.html 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\BIBUtils.dll 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cryptocme.sig 60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe -
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe"C:\Users\Admin\AppData\Local\Temp\60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1840
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 535aaa8aec15cd3756fd88d35652f9fc xorpv0a6MUWbGFSXMdI1yQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:2252