Analysis
-
max time kernel
166s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-06-2022 13:23
Static task
static1
Behavioral task
behavioral1
Sample
131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe
-
Size
361KB
-
MD5
3969f76be0d978d81cf587a7e8fab17a
-
SHA1
2f69a78547ed0a7cb6869c237b50c6ed6c54cd77
-
SHA256
131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044
-
SHA512
cdbebe34b661f449f9696c3bb2a27297b0e23e8e0b012d6a809c8a4ca12138fe2592170ea15c79076e3f9d3620f292a4847c48594459e207732e74037c14b2fc
Malware Config
Extracted
Path
C:\Restore-My-Files.txt
Ransom Note
All your files are Encrypted!
For data recovery needs decryptor.
How to buy decryptor:
----------------------------------------------------------------------------------------
| 1. Download Tor browser - https://www.torproject.org/ and install it.
| 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/
| 3. Follow the instructions on this page
----------------------------------------------------------------------------------------
Note! This link is available via "Tor Browser" only.
------------------------------------------------------------
Free decryption as guarantee.
Before paying you can send us 1 file for free decryption.
------------------------------------------------------------
alternate address - http://helpinfh6vj47ift.onion/
DO NOT CHANGE DATA BELOW
###s6dlsnhtjwbhr###�����������55 23 B9 A3 7E 87 A6 DB AD E4 9B F7 1E 96 A7 35
71 DC BC C7 B8 93 C6 E1 77 C1 ED 54 F1 D9 E3 BF
1B 2C C5 DD 77 1A 46 1A F7 60 E8 74 4C 1F A1 8A
12 FB 0C 0D 6F 90 2B D2 48 F7 AA 05 5E A3 EB 97
3E 9A 1E E6 DC 04 A3 8F A9 B1 1E 12 59 A1 39 2F
C3 35 0F 66 A5 39 9E 2A D3 00 DE B7 81 E5 27 0F
F3 FB 79 F9 22 DD 9B 3B 97 6B 95 C5 CF 45 FE F0
8F 0F 76 A0 64 EE 57 71 8F 79 48 E2 5F D6 FA 1E
96 22 F6 E4 FC 1E D3 0B C9 FD AF F0 32 C0 FF 62
14 17 0E 51 FB 68 4E 19 7C 0D 9C 74 5A 5E 54 79
0F 6B 40 89 F6 3F CC F0 72 7A D0 40 56 AA B3 6A
3B 38 D3 89 24 9F E1 92 8A 8B 6B B0 A2 08 6B BB
84 54 30 EE 09 59 18 67 28 0E D4 9F E4 BE A8 A9
AC 8C 4B 99 CD CF 18 01 EB C8 49 3D BE 23 2F 09
75 5B 1E FF A8 E2 2D 95 DB 86 F9 3A AE 6A 87 07
56 11 6B E0 8D 27 B6 1E 42 65 52 AA D4 87 83 43
###�������������
URLs
http://decrmbgpvh6kvmti.onion/
http://helpinfh6vj47ift.onion/
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\AddSync.raw => C:\Users\Admin\Pictures\AddSync.raw.DOCM 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File renamed C:\Users\Admin\Pictures\LimitProtect.png => C:\Users\Admin\Pictures\LimitProtect.png.DOCM 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File renamed C:\Users\Admin\Pictures\ResolveJoin.raw => C:\Users\Admin\Pictures\ResolveJoin.raw.DOCM 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Admin\Pictures\UnprotectSuspend.tiff 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File renamed C:\Users\Admin\Pictures\UnprotectSuspend.tiff => C:\Users\Admin\Pictures\UnprotectSuspend.tiff.DOCM 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe" 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe -
Drops desktop.ini file(s) 27 IoCs
description ioc Process File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Public\Music\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Admin\Music\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Public\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Public\Documents\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Admin\Links\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Public\Videos\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1680 set thread context of 1100 1680 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe 28 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Module.zip 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialMergeLetter.dotx 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\UrbanFax.Dotx 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Contacts.accdt 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\DADSHIRT.GIF 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielReport.Dotx 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INLAUNCH.DLL 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\Restore-My-Files.txt 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Custom.propdesc 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\SEAMARBL.HTM 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\MDIParent.zip 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Restore-My-Files.txt 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialResume.dotx 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginReport.Dotx 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\Restore-My-Files.txt 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Category.accft 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MAPIPH.DLL 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianReport.Dotx 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSRuntime.dll 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\IntroducingPowerPoint2010.potx 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Restore-My-Files.txt 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CSS7DATA0009.DLL 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPOLK.DLL 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Pitchbook.potx 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CharSetTable.chr 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPEDITOR.DLL 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.dll 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\JFONT.DAT 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.DesignTime.dll 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanLetter.Dotx 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Faculty.accdt 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Students.accdt 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Restore-My-Files.txt 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Right.accdt 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanMergeFax.Dotx 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Priority.accft 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PINELUMB.JPG 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPDESIGN.DLL 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FRENCH.LNG 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Installed_schemas14.xss 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieLetter.dotx 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginLetter.Dotx 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Contacts.accdt 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ.DLL 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUDIOSEARCHLTS.DLL 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUDIOSEARCHSAPIFE.DLL 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.SemiTrust.dll 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Restore-My-Files.txt 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveLetter.dotx 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Payment Type.accft 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File created C:\Program Files (x86)\Microsoft Office\Stationery\1033\Restore-My-Files.txt 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.SemiTrust.xml 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\DBGHELP.DLL 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INTLDATE.DLL 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File created C:\Program Files (x86)\Restore-My-Files.txt 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sqlceqp35.dll 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityReport.Dotx 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Dialog.accdt 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Phone.accft 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\OFFISUPP.GIF 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1680 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe 1680 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe 1680 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe 1680 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1680 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1680 wrote to memory of 1100 1680 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe 28 PID 1680 wrote to memory of 1100 1680 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe 28 PID 1680 wrote to memory of 1100 1680 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe 28 PID 1680 wrote to memory of 1100 1680 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe 28 PID 1680 wrote to memory of 1100 1680 131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe"C:\Users\Admin\AppData\Local\Temp\131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe"C:\Users\Admin\AppData\Local\Temp\131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe"2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1100
-