Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 11:23
Static task
static1
Behavioral task
behavioral1
Sample
1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe
Resource
win10v2004-20220414-en
General
-
Target
1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe
-
Size
740KB
-
MD5
95b62355385af3d2711b7a8e759ed664
-
SHA1
6c66c4005b14c14a1029a601eeed55cab21ae713
-
SHA256
1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420
-
SHA512
2b32851fd222e4fc06748b1f6f1f9b6b9ffd1e7d95e5c2c8665de0d55a825cd1918763d2b0af0200c2332dd5c5b33a5fe1183dc565046a7f457a00c4bee180dd
Malware Config
Signatures
-
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes:
resource yara_rule behavioral2/memory/3276-139-0x0000000002310000-0x0000000002342000-memory.dmp dave -
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exedescription ioc process File renamed C:\Users\Admin\Pictures\SwitchDismount.tiff => C:\Users\Admin\Pictures\SwitchDismount.tiff.QMIBK 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Pictures\UnlockUse.tiff 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File renamed C:\Users\Admin\Pictures\UnlockUse.tiff => C:\Users\Admin\Pictures\UnlockUse.tiff.QMIBK 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File renamed C:\Users\Admin\Pictures\RenameRead.raw => C:\Users\Admin\Pictures\RenameRead.raw.QMIBK 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File renamed C:\Users\Admin\Pictures\SearchGroup.tif => C:\Users\Admin\Pictures\SearchGroup.tif.QMIBK 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File renamed C:\Users\Admin\Pictures\SubmitCompare.raw => C:\Users\Admin\Pictures\SubmitCompare.raw.QMIBK 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Pictures\SwitchDismount.tiff 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File renamed C:\Users\Admin\Pictures\SuspendResolve.tif => C:\Users\Admin\Pictures\SuspendResolve.tif.QMIBK 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe -
Drops startup file 1 IoCs
Processes:
1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
Processes:
1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exedescription ioc process File opened for modification C:\Program Files\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Music\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Public\Videos\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Public\Music\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Links\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Public\Documents\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Public\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe -
Drops file in Program Files directory 64 IoCs
Processes:
1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ui-strings.js 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\desktop.ini 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ko-kr\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARABD.TTF 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ro.pak.DATA 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\Handler@1x.png 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\kok.pak 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluEmptyStateCCFiles_280x192.svg 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_checkbox_unselected_18.svg 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\plugin.js 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Resources.pri 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\uk-ua\ui-strings.js 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right-pressed.gif 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\ui-strings.js 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\ui-strings.js 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-BoldOblique.otf 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\external_extensions.json.DATA 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations.png 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f14\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Windows Mail 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\ui-strings.js 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\es-es\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\R3ADM3.txt 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyclient.jar 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exepid process 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 4656 vssvc.exe Token: SeRestorePrivilege 4656 vssvc.exe Token: SeAuditPrivilege 4656 vssvc.exe Token: SeIncreaseQuotaPrivilege 1996 WMIC.exe Token: SeSecurityPrivilege 1996 WMIC.exe Token: SeTakeOwnershipPrivilege 1996 WMIC.exe Token: SeLoadDriverPrivilege 1996 WMIC.exe Token: SeSystemProfilePrivilege 1996 WMIC.exe Token: SeSystemtimePrivilege 1996 WMIC.exe Token: SeProfSingleProcessPrivilege 1996 WMIC.exe Token: SeIncBasePriorityPrivilege 1996 WMIC.exe Token: SeCreatePagefilePrivilege 1996 WMIC.exe Token: SeBackupPrivilege 1996 WMIC.exe Token: SeRestorePrivilege 1996 WMIC.exe Token: SeShutdownPrivilege 1996 WMIC.exe Token: SeDebugPrivilege 1996 WMIC.exe Token: SeSystemEnvironmentPrivilege 1996 WMIC.exe Token: SeRemoteShutdownPrivilege 1996 WMIC.exe Token: SeUndockPrivilege 1996 WMIC.exe Token: SeManageVolumePrivilege 1996 WMIC.exe Token: 33 1996 WMIC.exe Token: 34 1996 WMIC.exe Token: 35 1996 WMIC.exe Token: 36 1996 WMIC.exe Token: SeIncreaseQuotaPrivilege 1996 WMIC.exe Token: SeSecurityPrivilege 1996 WMIC.exe Token: SeTakeOwnershipPrivilege 1996 WMIC.exe Token: SeLoadDriverPrivilege 1996 WMIC.exe Token: SeSystemProfilePrivilege 1996 WMIC.exe Token: SeSystemtimePrivilege 1996 WMIC.exe Token: SeProfSingleProcessPrivilege 1996 WMIC.exe Token: SeIncBasePriorityPrivilege 1996 WMIC.exe Token: SeCreatePagefilePrivilege 1996 WMIC.exe Token: SeBackupPrivilege 1996 WMIC.exe Token: SeRestorePrivilege 1996 WMIC.exe Token: SeShutdownPrivilege 1996 WMIC.exe Token: SeDebugPrivilege 1996 WMIC.exe Token: SeSystemEnvironmentPrivilege 1996 WMIC.exe Token: SeRemoteShutdownPrivilege 1996 WMIC.exe Token: SeUndockPrivilege 1996 WMIC.exe Token: SeManageVolumePrivilege 1996 WMIC.exe Token: 33 1996 WMIC.exe Token: 34 1996 WMIC.exe Token: 35 1996 WMIC.exe Token: 36 1996 WMIC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exepid process 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.execmd.exedescription pid process target process PID 3276 wrote to memory of 1848 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe cmd.exe PID 3276 wrote to memory of 1848 3276 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe cmd.exe PID 1848 wrote to memory of 1996 1848 cmd.exe WMIC.exe PID 1848 wrote to memory of 1996 1848 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe"C:\Users\Admin\AppData\Local\Temp\1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DAD79185-F5E6-48D1-959A-E300BEAF61B1}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DAD79185-F5E6-48D1-959A-E300BEAF61B1}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1848-140-0x0000000000000000-mapping.dmp
-
memory/1996-141-0x0000000000000000-mapping.dmp
-
memory/3276-130-0x00000000026B0000-0x00000000026E4000-memory.dmpFilesize
208KB
-
memory/3276-134-0x00000000026F0000-0x0000000002723000-memory.dmpFilesize
204KB
-
memory/3276-139-0x0000000002310000-0x0000000002342000-memory.dmpFilesize
200KB