Analysis Overview
SHA256
19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0
Threat Level: Known bad
The file 19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0 was found to be: Known bad.
Malicious Activity Summary
GlobeImposter
Modifies extensions of user files
Reads user/profile data of web browsers
Adds Run key to start application
Drops desktop.ini file(s)
Suspicious use of SetThreadContext
Drops file in Program Files directory
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-05-24 15:24
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-05-24 15:24
Reported
2022-05-24 15:57
Platform
win7-20220414-en
Max time network
46s
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2022-05-24 15:24
Reported
2022-05-24 15:57
Platform
win10v2004-20220414-en
Max time kernel
151s
Max time network
145s
Command Line
Signatures
GlobeImposter
Modifies extensions of user files
| Description | Indicator | Process | Target |
| File renamed | C:\Users\Admin\Pictures\CopyCompare.tiff => C:\Users\Admin\Pictures\CopyCompare.tiff.ReadInstructions | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\EditAssert.crw => C:\Users\Admin\Pictures\EditAssert.crw.ReadInstructions | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\FindExport.raw => C:\Users\Admin\Pictures\FindExport.raw.ReadInstructions | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\ReadReceive.raw => C:\Users\Admin\Pictures\ReadReceive.raw.ReadInstructions | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\CheckpointFormat.tif => C:\Users\Admin\Pictures\CheckpointFormat.tif.ReadInstructions | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\CopyCompare.tiff | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe" | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
Drops desktop.ini file(s)
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4344 set thread context of 1428 | N/A | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailBadge.scale-100.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-256_altform-unplated.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\Recovery_Instructions.html | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\close_x.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_link_18.svg | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\snapshot_blob.bin | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\resources.pri | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailWideTile.scale-400.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-16_altform-lightunplated.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_ta.dll | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\Recovery_Instructions.html | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\Recovery_Instructions.html | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.SmartGlass.dll | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\agavedefaulticon96x96.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_nb_135x40.svg | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.SmartGlass.winmd | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-32_altform-unplated_contrast-white.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-96_altform-unplated.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-unplated_contrast-black.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookLargeTile.scale-100.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupWideTile.scale-400.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionWideTile.scale-400.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\Recovery_Instructions.html | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\EditRestart.vssm | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\18.rsrc | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-300.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_uk.json | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\plugin.js | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_organize_18.svg | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppValueProp.svg | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.dll | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\Recovery_Instructions.html | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\Recovery_Instructions.html | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\RHP_icons.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-36_altform-unplated.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\config.lua | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Photos.Viewer.Plugins.Native.dll | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-64_altform-unplated_contrast-white.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-unplated_contrast-white.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\download-btn.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\Recovery_Instructions.html | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_ie8.gif | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-32_altform-unplated.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-256_altform-unplated.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-125_contrast-black.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-hover.svg | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\SplashScreen.scale-100.png | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\Recovery_Instructions.html | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\ErrorControl.xaml | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4344 wrote to memory of 1428 | N/A | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe |
| PID 4344 wrote to memory of 1428 | N/A | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe |
| PID 4344 wrote to memory of 1428 | N/A | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe | C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe
"C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe"
C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe
"C:\Users\Admin\AppData\Local\Temp\19398aace792fcf15014f7b8f614613c4cc114599aedeee89cf2b73bbbe947a0.exe"
Network
| Country | Destination | Domain | Proto |
| US | 93.184.220.29:80 | tcp | |
| US | 13.107.21.200:443 | tcp | |
| US | 13.89.179.8:443 | tcp | |
| US | 8.238.111.254:80 | tcp |
Files
memory/1428-130-0x0000000000000000-mapping.dmp
memory/4344-131-0x0000000000A70000-0x0000000000C10000-memory.dmp