Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
resource tags
arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2022 04:01
Static task
static1
Behavioral task
behavioral1
Sample
521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe
Resource
win7-20220715-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe
Resource
win10v2004-20220414-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe
-
Size
380KB
-
MD5
cefeba2bba1776d8b904415f52e14b7f
-
SHA1
733ab20ca21d86cd9a5fe4722c11783e51f88c9f
-
SHA256
521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e
-
SHA512
c869434f72fecc2b183ffd7d768a891a99e46d323a7f48da4db097f0a13e3510c3279ad8209b5ac2a6249c642ffb3ab749d4b225af5f6e2ee551e235b668c18e
Score
10/10
Malware Config
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\StartRequest.crw => C:\Users\Admin\Pictures\StartRequest.crw.PPTX 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File renamed C:\Users\Admin\Pictures\HideSearch.raw => C:\Users\Admin\Pictures\HideSearch.raw.PPTX 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe" 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe -
Drops desktop.ini file(s) 26 IoCs
description ioc Process File opened for modification C:\Users\Public\Documents\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\Links\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Public\Videos\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\Music\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Public\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Public\Music\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\main-selector.css 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sk-sk\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\es-es\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hu-hu\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\warning_2x.png 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_lt.dll 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\psuser.dll 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ar-ae\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\main-selector.css 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_ar.dll 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\da-dk\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main-selector.css 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\adobe_spinner.gif 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ja-jp\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-il\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search-2x.png 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main.css 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\az_get.svg 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-ae\READ_ME.txt 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\ui-strings.js 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\C: 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4896 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4896 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4896 wrote to memory of 756 4896 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe 79 PID 4896 wrote to memory of 756 4896 521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe"C:\Users\Admin\AppData\Local\Temp\521e8b48c7c4d54ffeaee381118505215b0dd36ada17b5452e1eaacac4e3a70e.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:756
-