Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
17-02-2022 13:59
Static task
static1
Behavioral task
behavioral1
Sample
71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe
-
Size
53KB
-
MD5
58c8c8c3038a5fbca2202248a1101da0
-
SHA1
d07e81d55f9fbc7702efb28ba2a37b855cb1cfbe
-
SHA256
71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c
-
SHA512
4ff4fb70971de46ea55e7f792760dc3bdb60912f537e5f201a05f070a0b09e82d6d3ca11389fa455e49702a44875d8423f49d0e31a543f480d71a9acb13bd3a7
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">����������80 AF 17 AC 15 D4 E6 BD AD 57 C3 FA 83 35 60 B6
02 C0 98 36 49 66 C5 3E 4D 09 E4 B0 03 D3 59 5C
54 46 04 F4 70 51 84 60 E8 09 3D 26 DC 83 53 43
FE 0D 33 4A 7A 5C 3C CB 2F 96 0C 2F 76 67 A3 A8
7D 04 6F 22 F6 27 6F 92 42 BE E7 4A 54 46 ED E4
6F 04 17 B2 6D 70 4A CB 7A 2D 70 5E B9 B9 AD 73
B5 9C 30 EF 58 76 97 A5 EA B8 76 5E B0 BC 31 AA
15 A1 10 1A E1 F5 40 9C 46 DC A5 F7 FC DC 7F 1B
11 94 68 17 72 AD BB D7 F4 13 9D FB 84 59 C7 A9
1A FE A5 D4 48 B0 85 8E 08 4D 30 BA 90 8C 63 A6
15 12 E2 8D 12 34 2C E1 A3 7B 41 6E F7 00 17 E8
5E 8F 0F 08 6E 31 4B 19 9F E7 9C DC 78 1F 06 BC
EE 7D 94 B6 7C 45 39 07 31 70 67 D5 09 25 72 EF
B2 8D 96 48 F5 60 A8 A4 12 A1 F0 FD 59 5A FD 8B
55 BF A5 07 E4 88 EB 81 21 78 FD 33 2A 7A 6E C9
5E 57 75 09 2E B2 62 BF 01 31 19 A6 4E E4 5A E2
</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>.onion
</a><br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new free email account on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�����������
Emails
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\EnableAssert.tiff => C:\Users\Admin\Pictures\EnableAssert.tiff.lockis 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File renamed C:\Users\Admin\Pictures\LimitMeasure.crw => C:\Users\Admin\Pictures\LimitMeasure.crw.lockis 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File renamed C:\Users\Admin\Pictures\RestorePush.crw => C:\Users\Admin\Pictures\RestorePush.crw.lockis 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Pictures\ResumeWatch.tiff 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File renamed C:\Users\Admin\Pictures\ResumeWatch.tiff => C:\Users\Admin\Pictures\ResumeWatch.tiff.lockis 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File renamed C:\Users\Admin\Pictures\BlockPush.raw => C:\Users\Admin\Pictures\BlockPush.raw.lockis 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Pictures\EnableAssert.tiff 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe" 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe -
Drops desktop.ini file(s) 26 IoCs
description ioc Process File opened for modification C:\Users\Public\Pictures\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Public\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Public\Documents\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Music\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Public\Videos\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Public\Music\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Links\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\mso20imm.dll 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailBadge.scale-400.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\main.css 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext-2x.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-hover_32.svg 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview_selected.svg 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_contrast-black.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailLargeTile.scale-200.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_altform-colorize.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libnsv_plugin.dll 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_signed_out.svg 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\PushDismount.txt 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-336.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailMediumTile.scale-200.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-24_contrast-black.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-150_contrast-white.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-64.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\ui-strings.js 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_altform-unplated_contrast-white.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-100.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main-selector.css 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-60_altform-lightunplated.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorMedTile.contrast-black_scale-100.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\how_to_back_files.html 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\ui-strings.js 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reportabuse-default_18.svg 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-200.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\locallaunch\locallaunch.css 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmotiondetect_plugin.dll 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-400.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Doughboy.scale-200.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.contrast-white_scale-200.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\how_to_back_files.html 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_contrast-white.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100_contrast-white.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_BillPay_Light.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\TecProxy.dll 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256_altform-unplated_contrast-black_devicefamily-colorfulunplated.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsBadge.contrast-white_scale-200.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Microsoft.Graphics.Canvas.winmd 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-200_contrast-black.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.targetsize-24.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\reflow.api 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\Studio.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\how_to_back_files.html 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-150.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptySearch.scale-200.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\how_to_back_files.html 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-tw_get.svg 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_contrast-black.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\how_to_back_files.html 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\SmallTile.scale-100.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-100.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookPromoTile.scale-100.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Msg_Received.m4a 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\plugin.js 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_47.dll 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-125_contrast-white.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_contrast-white.png 71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3804 svchost.exe Token: SeCreatePagefilePrivilege 3804 svchost.exe Token: SeShutdownPrivilege 3804 svchost.exe Token: SeCreatePagefilePrivilege 3804 svchost.exe Token: SeShutdownPrivilege 3804 svchost.exe Token: SeCreatePagefilePrivilege 3804 svchost.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe Token: SeRestorePrivilege 1396 TiWorker.exe Token: SeSecurityPrivilege 1396 TiWorker.exe Token: SeBackupPrivilege 1396 TiWorker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe"C:\Users\Admin\AppData\Local\Temp\71e3fce98a6436cf6a771732e9556106a071d86236f752d4540f669bef058f9c.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3804
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1396