Analysis
- max time kernel
156s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
15/06/2022, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe
- Size 230KB
- Sample220615-cbbkvafdgk
- SHA256 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7
- MD5 7f7eb2a3463e393d6c36710f5d6eebfa
- SHA1 a38b3be749b494ed0a73f00dca89069f97b53c0f
- SHA512 48ee1d9b1abf5836a2e88fd7e550531057912c1ee1b55aacc54c0d86884085cfcd8aff1c232cd7d1351d6b92e79b6a405214a94c53bceadbc78172a5954a51ab
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
- Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\EditResume.tiff 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File renamed C:\Users\Admin\Pictures\EditResume.tiff => C:\Users\Admin\Pictures\EditResume.tiff..doc 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File renamed C:\Users\Admin\Pictures\ApproveRequest.crw => C:\Users\Admin\Pictures\ApproveRequest.crw..doc 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File renamed C:\Users\Admin\Pictures\ConvertRestart.crw => C:\Users\Admin\Pictures\ConvertRestart.crw..doc 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File renamed C:\Users\Admin\Pictures\DisconnectResize.crw => C:\Users\Admin\Pictures\DisconnectResize.crw..doc 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe" 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe - Drops desktop.ini file(s) 26 IoCs
description ioc Process File opened for modification C:\Users\Public\Documents\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Public\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Public\Music\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_ta.dll 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\bun.png 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\it-it\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\it-it\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hr-hr\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\zx______.pfm 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pt-br\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\eu-es\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Confirmation.png 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ACE.dll 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pe.dll 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\bun.png 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_gu.dll 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\adc_logo.png 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nl-nl\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\plugin.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ca-es\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\plugin.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_iw.dll 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hr-hr\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons2x.png 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\psuser_64.dll 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\A3DUtils.dll 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\desktop.ini 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Regular.otf 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ar-ae\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-cn\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-tw\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_hr.dll 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_hu.dll 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeLinguistic.dll 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pt-br\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-fr\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pl-pl\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\checkmark-2x.png 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Confirmation.png 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\ui-strings.js 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\es-es\Read___ME.html 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4964 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe 4964 2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe"C:\Users\Admin\AppData\Local\Temp\2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4964