Malware Analysis Report

2024-10-18 23:00

Sample ID 220524-ss8vnsfhb9
Target 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0
SHA256 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0
Tags
globeimposter persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0

Threat Level: Known bad

The file 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0 was found to be: Known bad.

Malicious Activity Summary

globeimposter persistence ransomware spyware stealer

GlobeImposter

Modifies extensions of user files

Reads user/profile data of web browsers

Adds Run key to start application

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Program Files directory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-24 15:24

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-24 15:24

Reported

2022-05-24 15:57

Platform

win7-20220414-en

Max time network

46s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-24 15:24

Reported

2022-05-24 15:57

Platform

win10v2004-20220414-en

Max time kernel

151s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe"

Signatures

GlobeImposter

ransomware globeimposter

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\CopyCompare.tiff => C:\Users\Admin\Pictures\CopyCompare.tiff.ReadInstructions C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File renamed C:\Users\Admin\Pictures\EditAssert.crw => C:\Users\Admin\Pictures\EditAssert.crw.ReadInstructions C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File renamed C:\Users\Admin\Pictures\FindExport.raw => C:\Users\Admin\Pictures\FindExport.raw.ReadInstructions C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File renamed C:\Users\Admin\Pictures\ReadReceive.raw => C:\Users\Admin\Pictures\ReadReceive.raw.ReadInstructions C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File renamed C:\Users\Admin\Pictures\CheckpointFormat.tif => C:\Users\Admin\Pictures\CheckpointFormat.tif.ReadInstructions C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\Pictures\CopyCompare.tiff C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe" C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailBadge.scale-100.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\Recovery_Instructions.html C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\close_x.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_link_18.svg C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\snapshot_blob.bin C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailWideTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-16_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_ta.dll C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\Recovery_Instructions.html C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\Recovery_Instructions.html C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.SmartGlass.dll C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\agavedefaulticon96x96.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_nb_135x40.svg C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.SmartGlass.winmd C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-32_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-96_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookLargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupWideTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionWideTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\Recovery_Instructions.html C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\EditRestart.vssm C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\18.rsrc C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-300.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_uk.json C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\plugin.js C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_organize_18.svg C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppValueProp.svg C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.dll C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\Recovery_Instructions.html C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\ui-strings.js C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\Recovery_Instructions.html C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\RHP_icons.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-36_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\config.lua C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Photos.Viewer.Plugins.Native.dll C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-64_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\download-btn.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\Recovery_Instructions.html C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_ie8.gif C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\ui-strings.js C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\ui-strings.js C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\ui-strings.js C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\ui-strings.js C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-hover.svg C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\SplashScreen.scale-100.png C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\Recovery_Instructions.html C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\ErrorControl.xaml C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe

"C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe"

C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe

"C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe"

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 13.107.21.200:443 tcp
US 13.89.179.8:443 tcp
US 8.238.111.254:80 tcp

Files

memory/1428-130-0x0000000000000000-mapping.dmp

memory/4344-131-0x0000000000A70000-0x0000000000C10000-memory.dmp