Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 15:24
Static task
static1
Behavioral task
behavioral1
Sample
19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe
-
Size
618KB
-
MD5
79bff9e9dd33efdf85e402ef9246e4e5
-
SHA1
04e9920b948af3297ab2fafe3a339b06a0e5d7aa
-
SHA256
19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0
-
SHA512
6a2097cbf75633f4b433548927c84c1d075966e390550f841e877dda7e2813d32451f7fc2d7fa5cb26f8732b40edd8fd4355c445d0e2f636d6e3b467d6af82da
Score
10/10
Malware Config
Extracted
Path
C:\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">����������2A A9 0D 7B B0 DD 92 18 7B F9 DB D8 BE 00 C0 84
62 69 74 DD 54 E0 D6 73 98 05 B6 93 5F 99 10 8D
B4 86 3D BE 17 1A AB B9 8F 8A 53 A0 85 E7 21 4B
5F B4 2A 6B CC F2 EC 86 F6 DD 3D 05 1A 8E 85 8E
A0 88 87 F7 F0 31 51 02 A2 B0 58 73 A3 F8 3F 23
5B FA 00 9A E4 03 A3 14 9B AD 3A 2B CA 10 8A 2E
F5 65 72 27 C0 95 B0 E3 3B E9 D4 C3 C7 F4 34 97
C6 18 C1 22 E8 30 34 4A 1E C4 3C 14 8B 8A 07 C7
68 0A 36 5E 7A AD EA 15 AB 7B 7F F2 2E 10 F3 24
65 09 7A E4 68 09 7B E5 9C AD E4 D2 F7 F8 33 F9
00 DD 2F 66 8F F2 B8 F0 2B C1 F6 16 FF A9 CB B6
D6 28 BD E7 04 72 ED 1E 1F B4 22 71 35 4A D7 27
A9 AF 5F 12 8E 9E FE 6D 66 71 ED 69 55 E5 6E 5D
3A F1 CF 16 1B CD 5C AA B0 56 B1 F3 47 25 13 E3
7A C4 E7 78 0A 81 06 35 28 B6 F0 72 A4 4E F3 51
F9 EB 53 04 1D 60 57 1C 35 89 80 56 CC 74 06 94
</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price (BITCOIN) and get decryption software.</b><br><br>
<a href="mailto:[email protected]">[email protected]</a><br>
<a href="mailto:[email protected]">[email protected]</a> <hr>
</div>
<div class="text">
Make contact as soon as possible. Your private key (decryption key) is only <br>
stored temporarily.<br>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.<br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>�����������
Emails
href="mailto:[email protected]">[email protected]</a><br>
href="mailto:[email protected]">[email protected]</a>
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exedescription ioc Process File renamed C:\Users\Admin\Pictures\CopyCompare.tiff => C:\Users\Admin\Pictures\CopyCompare.tiff.ReadInstructions 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File renamed C:\Users\Admin\Pictures\EditAssert.crw => C:\Users\Admin\Pictures\EditAssert.crw.ReadInstructions 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File renamed C:\Users\Admin\Pictures\FindExport.raw => C:\Users\Admin\Pictures\FindExport.raw.ReadInstructions 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File renamed C:\Users\Admin\Pictures\ReadReceive.raw => C:\Users\Admin\Pictures\ReadReceive.raw.ReadInstructions 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File renamed C:\Users\Admin\Pictures\CheckpointFormat.tif => C:\Users\Admin\Pictures\CheckpointFormat.tif.ReadInstructions 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\Pictures\CopyCompare.tiff 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe" 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe -
Drops desktop.ini file(s) 27 IoCs
Processes:
19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exedescription ioc Process File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Public\Music\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Public\Documents\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Public\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\Links\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Public\Videos\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Users\Admin\Music\desktop.ini 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exedescription pid Process procid_target PID 4344 set thread context of 1428 4344 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe 80 -
Drops file in Program Files directory 64 IoCs
Processes:
19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exedescription ioc Process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailBadge.scale-100.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-256_altform-unplated.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\Recovery_Instructions.html 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\close_x.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_link_18.svg 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\snapshot_blob.bin 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\resources.pri 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailWideTile.scale-400.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-16_altform-lightunplated.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_ta.dll 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\Recovery_Instructions.html 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\Recovery_Instructions.html 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.SmartGlass.dll 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\agavedefaulticon96x96.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_nb_135x40.svg 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.SmartGlass.winmd 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-32_altform-unplated_contrast-white.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\ui-strings.js 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-96_altform-unplated.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-unplated_contrast-black.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookLargeTile.scale-100.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupWideTile.scale-400.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionWideTile.scale-400.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\Recovery_Instructions.html 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\EditRestart.vssm 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\18.rsrc 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-300.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_uk.json 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\plugin.js 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_organize_18.svg 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppValueProp.svg 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.dll 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\Recovery_Instructions.html 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\ui-strings.js 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\Recovery_Instructions.html 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\RHP_icons.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-36_altform-unplated.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\config.lua 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Photos.Viewer.Plugins.Native.dll 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-64_altform-unplated_contrast-white.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-unplated_contrast-white.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\download-btn.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\Recovery_Instructions.html 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_ie8.gif 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\ui-strings.js 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\ui-strings.js 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\ui-strings.js 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-32_altform-unplated.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-256_altform-unplated.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\ui-strings.js 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-125_contrast-black.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-hover.svg 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\SplashScreen.scale-100.png 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\Recovery_Instructions.html 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\ErrorControl.xaml 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exepid Process 4344 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe 4344 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exepid Process 4344 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exedescription pid Process procid_target PID 4344 wrote to memory of 1428 4344 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe 80 PID 4344 wrote to memory of 1428 4344 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe 80 PID 4344 wrote to memory of 1428 4344 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe"C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe"C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe"2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1428
-