Analysis
-
max time kernel
158s -
max time network
138s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-02-2022 06:58
Static task
static1
Behavioral task
behavioral1
Sample
4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe
-
Size
55KB
-
MD5
f191cec3e5b88c82e95915eba4458689
-
SHA1
0a21e393fa24c428d2c9f987fe3d9e6b0eddea5b
-
SHA256
4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5
-
SHA512
568b5cc2de28b0c2639a5d2ea5ac6052d743f65281ae6bbf02108d4e7226c54533a1b2ce9ab3cf7357356314cb3ac5bd5ea28c5fca9e10f3d56829e9382f436a
Score
10/10
Malware Config
Extracted
Path
C:\HOW_TO_BACK_FILES.html
Ransom Note
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style type="text/css">
body {
background-color: #252525;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 5px;
color: #FF0000;
background: #1C1A1B;
}
.letter {
color: #FF0000;
font-weight: 600
}
.tabs1 .identi {
margin-left: 0px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #1C1A1B;
color: #F1EADA;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #F1EADA;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #1C1A1B;
color: #F1EADA;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top:0;
background: #1C1A1B;
color: #E29F12;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head"><h3>Your personal ID</h3></div>
<div class="identi">
<pre><span class="letter">72 A5 A3 4A A5 15 DB 00 52 F5 19 0B 6C BE 9F 4C
A1 99 FF 4D 4A 26 30 A8 CA C8 9D 82 FB BA 56 98
1C 9D 3D 79 B9 44 98 EB 7C D4 89 27 25 9F 39 B2
A7 60 34 17 17 7C 1F A3 9A 79 1B D9 C9 DB 24 59
46 6B F7 EB B7 B2 78 20 5C 03 D0 62 0D 47 50 F2
95 96 52 E2 F8 B9 D1 87 F3 F1 7E 55 AD 8C 7A CE
22 71 1F C0 FE 96 30 F4 62 E3 CD 8C E6 ED F3 AD
51 13 C2 B9 A2 8E AE A5 B0 22 5F E8 AA 0E 2C 29
52 A7 E9 03 CF 7B 0E FD 92 4B 2A F6 E0 D8 81 74
8F 24 AB 16 41 CD A0 70 F7 2F EE 78 5F CC E6 74
8C A1 58 B3 C5 84 8C B8 C0 B0 B4 A4 61 1C 67 82
D2 5B 4A E6 C3 DD 83 AB B9 E5 B9 9D 3C D6 63 C1
C8 9B 90 75 84 96 F9 79 90 9C DC C5 7B 37 3E 81
C9 6C 6A 55 3E D2 55 E6 55 8A D9 3A D6 5C 89 9C
21 B4 58 AB 88 B0 30 62 54 1E D9 A8 BB A9 B4 F6
4A 4C FF BE 68 6B 8F 70 3D 07 C1 82 5B C7 83 4C
</span><p></p>
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input name="tabs" checked="checked" id="tab1" type="radio">
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☣ Your files are encrypted! ☣</h1>
<h3> To decrypt, follow the instructions below. </h3>
<br>
<div class="text">
<!--text data -->
To recover data you need decryptor.<br>
To get the decryptor you should:<br>
<p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span><br>
(Or alternate mail <span class="letter"> [email protected]</span>)</p><p>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files<p></p>
After we send you instruction how to pay for decrypt and
after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we
have the decoder.<br>
<p>
<hr color="#FF0000">
<center><b><p style="color: #FF0000;">MOST IMPORTANT!!!</p></center>
<center><p style="color: #FF0000;"> You can not decrypt your files cheaper than we offer you.
You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE.
No one, except [email protected], will decrypt your files with a guarantee 100%. </b></p></center>
<hr color="#FF0000">
<ul>
<li>Only [email protected] can with a guarantee decrypt your files </li>
<li>Do not trust anyone besides [email protected]</li>
<li>Antivirus programs can delete this document and you can not contact us later.</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
<!--tab-->
</body></html>
Emails
URLs
http-equiv="Content-Type"
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\StartUndo.tiff => C:\Users\Admin\Pictures\StartUndo.tiff.XXXXX 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File renamed C:\Users\Admin\Pictures\GrantAssert.crw => C:\Users\Admin\Pictures\GrantAssert.crw.XXXXX 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File renamed C:\Users\Admin\Pictures\SetRegister.raw => C:\Users\Admin\Pictures\SetRegister.raw.XXXXX 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Pictures\SkipPing.tiff 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File renamed C:\Users\Admin\Pictures\SkipPing.tiff => C:\Users\Admin\Pictures\SkipPing.tiff.XXXXX 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Pictures\StartUndo.tiff 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File renamed C:\Users\Admin\Pictures\UndoRepair.raw => C:\Users\Admin\Pictures\UndoRepair.raw.XXXXX 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File renamed C:\Users\Admin\Pictures\GroupOut.png => C:\Users\Admin\Pictures\GroupOut.png.XXXXX 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File renamed C:\Users\Admin\Pictures\InitializeSet.raw => C:\Users\Admin\Pictures\InitializeSet.raw.XXXXX 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Pictures\MeasureDebug.tiff 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File renamed C:\Users\Admin\Pictures\MeasureDebug.tiff => C:\Users\Admin\Pictures\MeasureDebug.tiff.XXXXX 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe" 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe -
Drops desktop.ini file(s) 27 IoCs
description ioc Process File opened for modification C:\Users\Public\Recorded TV\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Public\Videos\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Public\Documents\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Public\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Links\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Public\Music\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Music\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryNewsletter.dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityMergeFax.Dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Assets.accdt 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Users.accdt 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.HTM 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfig.zip 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\ResourceInternal.zip 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianLetter.Dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanMergeLetter.Dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Tabs.accdt 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyReport.dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BillingStatement.xltx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSStr32.dll 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.InfoPath.FormControl.dll 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7.dll 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\HOW_TO_BACK_FILES.html 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialReport.dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FiveRules.potx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanLetter.Dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Faculty.accdt 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUTHZAX.DLL 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\bdcmetadata.xsd 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXLIRMV.XML 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\HOW_TO_BACK_FILES.html 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityResume.Dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.SharePoint.BusinessData.Administration.Client.dll 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSAEXP30.DLL 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ProjectStatusReport.potx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\List.accdt 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Priority.accft 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEAWSDC.DLL 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7fr.dll 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7es.kic 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyResume.dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityMergeLetter.Dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\HOW_TO_BACK_FILES.html 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.GIF 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\DADSHIRT.HTM 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENGLISH.LNG 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MORPH9.DLL 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveLetter.dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\EquityFax.Dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPOLK.DLL 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessData.dll 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_en.dub 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\OriginFax.Dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\QuizShow.potx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Details.accdt 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Dialog.accdt 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUDGESCH.HTM 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.dll 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieResume.dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityLetter.Dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Status.accft 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7en.dll 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_fr.dub 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Text.zip 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sqlceoledb35.dll 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanResume.Dotx 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PAWPRINT.HTM 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ.DLL 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1576 4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe"C:\Users\Admin\AppData\Local\Temp\4b2dba3f93addfb060c92789b8d3230ecaaa5d559e942a876c82dd384588cca5.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1576