Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
30-03-2022 02:47
Static task
static1
Behavioral task
behavioral1
Sample
965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe
-
Size
2.9MB
-
MD5
d4ddfd6ce54841bddce22d8ca819363b
-
SHA1
4148288be1d9250c29f5af83ef27b468787bcdbb
-
SHA256
965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a
-
SHA512
eafbc1c3d96b5720368b38e39237460ebd0a1c1d709336dc47c4af61e20c9d19b6dae437459aa4c86534754965f1fc66ba67cac132ba3072e4798e7f94085cc4
Score
10/10
Malware Config
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\CheckpointJoin.tiff 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File renamed C:\Users\Admin\Pictures\CheckpointJoin.tiff => C:\Users\Admin\Pictures\CheckpointJoin.tiff.xls 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File renamed C:\Users\Admin\Pictures\ExportFormat.png => C:\Users\Admin\Pictures\ExportFormat.png.xls 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File renamed C:\Users\Admin\Pictures\StartWait.raw => C:\Users\Admin\Pictures\StartWait.raw.xls 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe" 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe -
Drops desktop.ini file(s) 26 IoCs
description ioc Process File opened for modification C:\Users\Public\Libraries\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\Links\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Public\Videos\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Public\Documents\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Public\Music\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\Music\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Public\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\desktop.ini 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2700 set thread context of 1452 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 82 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ui-strings.js 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\RenameClear.rmi 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-40.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.dll 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\ui-strings.js 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner2x.gif 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\GroupOpen.dxf 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-400.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Text.Encoding.CodePages.dll 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\1.rsrc 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_sl.json 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-80_altform-unplated.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\onintlim.dll 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\MyOffice.BackgroundTasks.winmd 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OLKFSTUB.DLL 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\next-arrow-down.svg 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxSignature.p7x 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\common.js 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.pdf 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\ui-strings.js 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-80_altform-unplated.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-200.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Sand.dxt 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-125_contrast-high.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-xstate-l2-1-0.dll 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNB.TTF 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AXE8SharedExpat.dll 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-tw\ui-strings.js 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\ui-strings.js 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-64.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\office.odf 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-200.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_altform-lightunplated.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\ui-strings.js 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Dark\Cabinet.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\ui-strings.js 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-100.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\thumb_stats_render_smallest.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\ui-strings.js 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\My_Files.txt 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-20.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubWideTile.scale-200_contrast-white.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailBadge.scale-200.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\BuildInfo.xml 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\183.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\WideTile.scale-125.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\bun.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libGLESv2.dll 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\js\url-polyfill.min.js 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_de.json 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SplashWideTile.scale-100_contrast-black.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-150.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FetchingMail.scale-400.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-64.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\resources.pri 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\skype-to-phone-tiny.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\trdtv2r41.xsl 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\ui-strings.js 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-unplated_contrast-white.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl.winmd 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4348 2700 WerFault.exe 77 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2700 wrote to memory of 1452 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 82 PID 2700 wrote to memory of 1452 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 82 PID 2700 wrote to memory of 1452 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 82 PID 2700 wrote to memory of 1452 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 82 PID 2700 wrote to memory of 1452 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 82 PID 2700 wrote to memory of 1452 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 82 PID 2700 wrote to memory of 1452 2700 965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe"C:\Users\Admin\AppData\Local\Temp\965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe"C:\Users\Admin\AppData\Local\Temp\965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe"2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 10482⤵
- Program crash
PID:4348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2700 -ip 27001⤵PID:4240