Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
169s -
max time network
138s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11/02/2022, 06:38
Static task
static1
Behavioral task
behavioral1
Sample
aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe
-
Size
55KB
-
MD5
1748fc9c3457f6102469044a18a67095
-
SHA1
ff7a2abf8f53c2cac4d2d7d8c70b1784362414bb
-
SHA256
aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc
-
SHA512
3b2baccde64139657ba2cfcb17398078956b8302f32347ff344861ade61f26496e61a8f913df02ce56d7628ee58381b695fd58f92500cd0f9d0c00a9bd6d3463
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 5px;
color: #FF0000;
background: #303030;
}
.letter {
color: #DC143C;
font-weight: 600
}
.tabs1 .identi {
margin-left: 0px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top:0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>83 02 70 9D 3B ED B3 72 FD 78 BA F5 1A D6 50 3F
70 5C 48 DB B0 71 46 9C D1 CE 02 52 DA 1D F3 43
B2 92 0F 2D 0C 06 5E 54 9C 31 70 ED 46 FA F5 2D
65 91 BE C8 20 F5 9B 03 97 C4 B9 D2 B7 E8 6F 87
F5 2C FC F6 39 00 6B B5 40 93 EC EA 15 35 A6 6D
F9 CC 99 C3 C3 63 1A 9B AC 6E 59 D8 F7 1F 5A 1D
43 70 59 18 22 A1 F5 BF 85 25 6F 96 C4 DD 27 DC
AB 0E 3D 56 06 2C 0F 80 1F D3 E2 97 85 94 81 70
09 DB C9 65 42 F7 16 5C 47 C9 FA 7E 74 1A FF 09
BB 07 35 0B 69 27 36 20 50 99 CD 5B 0E FF 31 EE
0C F7 3D 88 45 95 0D 7E 25 D1 2A 5F 3F AF 81 AD
5B 09 3C A6 32 9A AF 8F 9E EF B5 83 09 F9 17 7E
49 3F B8 2E 59 C3 1E 11 2D 16 6A 5D BE 9E 58 EF
3F 93 50 CC F3 BE D7 62 8F 68 38 C2 DA B4 B7 C1
12 D3 B7 91 BC 3F 23 EC F6 9B 53 04 A7 7F 16 59
D3 F4 FE EC 2F FD FB 43 BF 35 C8 65 FB 05 4F 84
</p>
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☣ Your files are encrypted! ☣</h1>
<hr/>
<h3> To decrypt, follow the instructions below. </h3>
<br/>
<div class="text">
<!--text data -->
To recover data you need decryptor.</br>
To get the decryptor you should:</br>
<p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span></br>
(Or alternate mail <span class="letter"> [email protected]</span>)<p>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files</p>
After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we have the decoder.</br>
<hr color=red>
<center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center>
<center><p style="color:#FF0000"> You can not decrypt your files cheaper than we offer you.
You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE.
No one, except [email protected], will decrypt your files with a guarantee 100%. </p></center>
<hr color=red>
<ul>
<li>Only [email protected] can with a guarantee decrypt your files </li>
<li>Do not trust anyone besides [email protected]</li>
<li>Antivirus programs can delete this document and you can not contact us later.</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ConnectInvoke.tiff aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe" aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe -
Drops desktop.ini file(s) 27 IoCs
description ioc Process File opened for modification C:\Users\Admin\Saved Games\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Public\Documents\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Admin\Documents\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Public\Music\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Public\Libraries\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Public\Downloads\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Public\Videos\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Admin\Videos\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Public\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Public\Pictures\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Admin\Music\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Admin\Links\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Public\Desktop\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Admin\Searches\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7cm_en.dub aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7cm_es.dub aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSWORD.OLB aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\how_to_back_files.html aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INLAUNCH.DLL aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPIRM.XML aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\EquityFax.Dotx aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Students.accdt aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Top.accdt aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Name.accft aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCDDSF.DLL aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\SettingsInternal.zip aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BloodPressureTracker.xltx aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ExpenseReport.xltx aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMABLT32.DLL aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveLetter.dotx aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\bdcmetadata.xsd aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Graph.exe.manifest aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\how_to_back_files.html aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.Tools.Applications.Project.dll aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\SynchronizationEula.rtf aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.xml aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7cm_fr.dub aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.dll aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.JPG aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUDIOSEARCHSAPIFE.DLL aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.BusinessData.xml aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.dll aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Marketing Projects.accdt aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Tasks.accdt aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCVDT.DLL aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Issues.accdt aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Projects.accdt aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CSS7DATA0009.DLL aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EntityPicker.dll aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.Server.dll aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.SqlServerCe.dll aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\how_to_back_files.html aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7db.kic aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ContemporaryPhotoAlbum.potx aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanReport.Dotx aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Faculty.accdt aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSTYLE.DLL aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryLetter.dotx aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7tk.dll aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSODCW.DLL aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCDDSLM.DLL aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUTL.OLB aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mspub.exe.manifest aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MYSL.ICO aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Office Word 2003 Look.dotx aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Priority.accft aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOCF.DLL aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\UrbanFax.Dotx aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\107.accdt aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1608 aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe"C:\Users\Admin\AppData\Local\Temp\aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1608