Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-06-2022 04:26
Static task
static1
Behavioral task
behavioral1
Sample
22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
-
Size
220KB
-
MD5
0f79c1cda4b2f9230203cf1def2a9d02
-
SHA1
609d9c995e7d1f657d56e12c388234d76bffcb83
-
SHA256
22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a
-
SHA512
631381caeb6598ac284f0bacba3d840496a571db1573c4550ece8a2414a3c76291e0aa160b7ce38a31ce22eb34a8ccbd12b44c46f7bf10bb7e3221f77a747d3c
Score
10/10
Malware Config
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SubmitResume.tif => C:\Users\Admin\Pictures\SubmitResume.tif..doc 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File renamed C:\Users\Admin\Pictures\SyncGroup.tif => C:\Users\Admin\Pictures\SyncGroup.tif..doc 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File renamed C:\Users\Admin\Pictures\UnprotectResume.raw => C:\Users\Admin\Pictures\UnprotectResume.raw..doc 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Pictures\HideResume.tiff 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File renamed C:\Users\Admin\Pictures\HideResume.tiff => C:\Users\Admin\Pictures\HideResume.tiff..doc 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File renamed C:\Users\Admin\Pictures\JoinMove.raw => C:\Users\Admin\Pictures\JoinMove.raw..doc 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File renamed C:\Users\Admin\Pictures\LockProtect.crw => C:\Users\Admin\Pictures\LockProtect.crw..doc 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File renamed C:\Users\Admin\Pictures\OptimizeUnlock.png => C:\Users\Admin\Pictures\OptimizeUnlock.png..doc 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe" 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe -
Drops desktop.ini file(s) 27 IoCs
description ioc Process File opened for modification C:\Users\Public\Videos\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Public\Documents\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Music\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Links\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Public\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Public\Music\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AttachmentPlaceholder-Dark.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptySearch.scale-400.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-100_contrast-black.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\BadgeLogo.scale-100_contrast-white.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeBadge.scale-100.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailMediumTile.scale-100.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSplashLogo.scale-400.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Core.dll 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-20.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-dark-focus_32.svg 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\BuildInfo.xml 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\fr-FR.PhoneNumber.ot 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main.css 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\ui-strings.js 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\Read___ME.html 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\resources.pri 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-300.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-125_contrast-black.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Sand.jpg 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\Read___ME.html 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\main-selector.css 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\ui-strings.js 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\YelpLogo.svg 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-150.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-72_altform-unplated.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-400.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\clrcompression.dll 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\Read___ME.html 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Square150x150Logo.scale-125.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Reflection.Emit.Lightweight.dll 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarLogoExtensions.scale-256.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-32_contrast-white.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-100_contrast-black.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\2px.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pl-pl\ui-strings.js 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\ui-strings.js 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\Read___ME.html 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-200.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_contrast-black.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\WideTile.scale-125.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\ui-strings.js 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_duplicate_18.svg 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MoviesAnywhereLogoWithTextDark.scale-200.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsb.ttf 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20_altform-unplated.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\import_google_contacts\googleImportNoResults.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookLargeTile.scale-200.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\ui-strings.js 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\Read___ME.html 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailSmallTile.scale-150.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\CsiImm.dll 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\he-IL\View3d\3DViewerProductDescription-universal.xml 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-125_contrast-white.png 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\ui-strings.js 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2540 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe 2540 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe"C:\Users\Admin\AppData\Local\Temp\22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2540