Analysis
-
max time kernel
151s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
17-02-2022 13:56
Static task
static1
Behavioral task
behavioral1
Sample
fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe
-
Size
53KB
-
MD5
81fc683982ed765613c7b5162e515fc4
-
SHA1
9f51654df74aee64550cad2dedec3d956210ba17
-
SHA256
fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1
-
SHA512
d874e27c689842bf0b7074950ab5697f1c4662fc2832b5c060168988a20f0eb6d12e2dc63a272df9e09f7fb18fd116f78eb5bf8d6332db8f51d5a4013a60065c
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">����������6B 18 C8 BF 6F F0 8E 43 56 E5 D3 26 38 14 6C 77
D4 70 D8 3C D3 B0 7A 93 8B 00 06 00 CC 25 F9 6A
E5 89 FC B1 E5 B8 88 79 DF 44 DA 01 42 04 8B C7
30 FD 44 F8 CB D5 DC 12 ED EB 01 76 A7 20 29 AD
A9 DC 67 CD D1 0B 91 7C 37 12 C9 B6 19 6A 6F 37
C6 DE 41 5A 3A 38 93 47 69 0B D3 88 FB 2D BA E0
7B 93 8F 08 E2 E0 88 BF A5 F4 3C F3 1B 3C 10 4E
FE 10 0B D7 24 B2 BD 54 05 65 06 98 3C 11 14 2E
98 AB 49 0D BD 68 8E 36 16 36 39 E3 B6 05 A2 5B
13 8B 33 EA 3D 56 E6 95 FD 76 86 D0 4C 55 1C 60
1B AB 68 B7 EB C8 AC D9 3B 4E A2 9B CB 96 90 E2
21 B2 51 43 60 8C E6 B3 9E D3 3F 42 03 65 C9 FC
59 AD CB 3B 1F F1 06 F5 75 A0 D7 4C 1B C0 BC 9C
61 F4 D8 B7 7B 84 A4 A3 1D 00 E9 82 62 99 79 EB
FF D6 F8 6D 37 EF AE A0 74 50 DA 9D 92 0B 3D 3D
C0 DA C1 05 5B FD 7D 22 4C 5A 4D 96 92 98 21 E0
</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
��������������
Emails
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\AssertUnlock.crw => C:\Users\Admin\Pictures\AssertUnlock.crw.marlock011 fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File renamed C:\Users\Admin\Pictures\ClearReset.raw => C:\Users\Admin\Pictures\ClearReset.raw.marlock011 fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Users\Admin\Pictures\InitializeExit.tiff fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File renamed C:\Users\Admin\Pictures\InitializeExit.tiff => C:\Users\Admin\Pictures\InitializeExit.tiff.marlock011 fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File renamed C:\Users\Admin\Pictures\ResolveInvoke.png => C:\Users\Admin\Pictures\ResolveInvoke.png.marlock011 fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File renamed C:\Users\Admin\Pictures\UpdateShow.tif => C:\Users\Admin\Pictures\UpdateShow.tif.marlock011 fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File renamed C:\Users\Admin\Pictures\ApproveNew.crw => C:\Users\Admin\Pictures\ApproveNew.crw.marlock011 fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe" fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp3.scale-200.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxAccountsSplashLogo.scale-140.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-125.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\accessibilitychecker\main.js fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\uk-ua\ui-strings.js fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_retina.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageSmallTile.scale-400.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-150_contrast-white.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\ui-strings.js fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\ui-strings.js fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\LargeTile.scale-200.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchSmallTile.contrast-white_scale-100.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\how_to_back_files.html fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforcomments.svg fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\eu-es\ui-strings.js fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-32_altform-unplated.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-windows.jar fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\how_to_back_files.html fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-24.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_scale-100.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\how_to_back_files.html fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\how_to_back_files.html fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailLargeTile.scale-200.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\people_fre_motionAsset_p2.mp4 fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-100_altform-lightunplated.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\ui-strings.js fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\ui-strings.js fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7e3.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\MedTile.scale-100.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\how_to_back_files.html fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\ui-strings.js fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\ui-strings.js fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_contrast-white.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\skype-to-phone-tiny.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\DemoModeInk.dat fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-200_contrast-black.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-16_altform-lightunplated.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-200_contrast-white.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\MarkAsReadToastQuickAction.scale-80.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-unplated.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-16.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookMedTile.scale-200.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-150_contrast-black.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\how_to_back_files.html fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.scale-100.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-150_contrast-black.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-32_altform-lightunplated.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\CommunityInterop.winmd fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerLargeTile.contrast-black_scale-100.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Fonts\BroMDL2.2.33.ttf fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\WideTile.scale-125.png fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1500 svchost.exe Token: SeCreatePagefilePrivilege 1500 svchost.exe Token: SeShutdownPrivilege 1500 svchost.exe Token: SeCreatePagefilePrivilege 1500 svchost.exe Token: SeShutdownPrivilege 1500 svchost.exe Token: SeCreatePagefilePrivilege 1500 svchost.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe Token: SeRestorePrivilege 1656 TiWorker.exe Token: SeSecurityPrivilege 1656 TiWorker.exe Token: SeBackupPrivilege 1656 TiWorker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe"C:\Users\Admin\AppData\Local\Temp\fa5ca28f848e47e8eff8c50d548d5117a3834500fc92134602cc1a672a592ff1.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops file in Program Files directory
PID:3796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1656