Analysis
-
max time kernel
149s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 14:31
Static task
static1
Behavioral task
behavioral1
Sample
5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe
Resource
win7-20220718-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe
-
Size
528KB
-
MD5
22dce5b7daed8cfb14aa9e8e7eed1d2f
-
SHA1
ad04ba678cdc09526804c6f2a6341b221c9ac73f
-
SHA256
5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2
-
SHA512
64cd8f6c65f31e8a6e7db7a9dbb892f36b553ccdf7f4327f06148fd93fc2e50228351b99318daf2512aa00d901791d1b3c997d291a17ade5eb2ffaf224069f09
Malware Config
Extracted
Path
C:\Restore-My-Files.txt
Ransom Note
All your files are Encrypted!
For data recovery needs decryptor.
How to buy decryptor:
----------------------------------------------------------------------------------------
| 1. Download Tor browser - https://www.torproject.org/ and install it.
| 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/
| 3. Follow the instructions on this page
----------------------------------------------------------------------------------------
Note! This link is available via "Tor Browser" only.
------------------------------------------------------------
Free decryption as guarantee.
Before paying you can send us 1 file for free decryption.
------------------------------------------------------------
alternate address - http://helpinfh6vj47ift.onion/
DO NOT CHANGE DATA BELOW
###s6dlsnhtjwbhr###�����������04 74 7E EA 7A 8B 82 F5 32 A3 0A 17 4F 69 07 A2
87 41 5D 24 78 9F 30 08 AB FE F6 66 A3 60 5A 00
FC 39 C9 A6 05 F8 92 21 3C 7C 9C 46 D7 13 7D 1A
72 B1 33 43 FB 1B EE 0D 8B FB 47 46 7B 19 CA FC
E9 70 48 D0 3A B2 C8 33 B7 63 68 BB 5A D3 E4 C4
48 3B 01 A2 5E 31 17 67 73 B8 81 21 00 8B 69 35
B0 7E D8 74 15 EC F3 38 A6 B3 CE 66 9D 6D 94 50
45 9E 3B C7 98 F0 D8 D6 7D 8D 11 FA 38 22 FB 5C
53 67 3A BF 41 08 9E 79 13 E6 A4 5D 30 FC 31 CE
65 A6 FF 3E 21 DB FB DD 78 65 41 D9 B0 69 D5 70
D7 8B 62 E3 B7 6D 24 BA 83 CC 8C 41 F6 D2 9B 3D
B0 5B 2E 2D 77 53 7F 1F 5F F4 29 8D 09 0D 9C D6
DD F6 B3 60 54 A5 0B 6D 49 D4 43 C2 C5 00 B2 20
B1 06 49 76 24 74 15 4E 6A B9 BD 64 87 00 A5 16
13 EF D6 FE 2E BF 60 EE 82 30 62 8D D2 45 48 63
15 FD 9B 65 6D 2E 43 D9 2F 03 E8 A7 F4 E5 CA D8
###�������������
URLs
http://decrmbgpvh6kvmti.onion/
http://helpinfh6vj47ift.onion/
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ConfirmMove.png => C:\Users\Admin\Pictures\ConfirmMove.png.DOCM 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File renamed C:\Users\Admin\Pictures\EnterSync.tif => C:\Users\Admin\Pictures\EnterSync.tif.DOCM 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File renamed C:\Users\Admin\Pictures\GetPing.crw => C:\Users\Admin\Pictures\GetPing.crw.DOCM 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File renamed C:\Users\Admin\Pictures\MoveEnable.crw => C:\Users\Admin\Pictures\MoveEnable.crw.DOCM 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe" 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe -
Drops desktop.ini file(s) 27 IoCs
description ioc Process File opened for modification C:\Users\Admin\Music\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Public\Videos\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Public\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Public\Documents\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Admin\Links\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Public\Music\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1620 set thread context of 948 1620 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe 27 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\Restore-My-Files.txt 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTIRM.XML 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN002.XML 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\1 Top.accdt 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\Restore-My-Files.txt 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Premium.gif 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\Restore-My-Files.txt 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginLetter.Dotx 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7tk.dll 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_choosecolor.gif 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsVersion1Warning.htm 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\background.gif 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Contacts.accdt 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENVHM.POC 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIconsMask.bmp 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATWIZ11.POC 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCOUPON.DPV 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\Restore-My-Files.txt 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid_over.gif 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\WidescreenPresentation.potx 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBEMAIL.POC 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\Restore-My-Files.txt 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_VelvetRose.gif 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen.css 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Office Word 2003 Look.dotx 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LTHD98.POC 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL103.XML 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.IN.XML 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\WSS_DocLib.ico 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\Restore-My-Files.txt 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyResume.dotx 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCDDS.DLL 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MCPS.DLL 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\HAMMER.WAV 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\BUTTON.GIF 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSClient.Msg.dll 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\MAIL.ICO 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl.css 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime.css 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dialog.zip 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Northwind.accdt 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FORMCTL.POC 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\ALERT.ICO 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Casual.gif 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BloodPressureTracker.xltx 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUTHZAX.DLL 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL98.POC 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\InfoPathWelcomeImage.jpg 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis.css 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMSMDB32.DLL 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7ES.LEX 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CA.XML 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\form_edit.js 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\attention.gif 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Right.accdt 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGATNGET.DPV 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPUNCT.DPV 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB7.BDR 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL001.XML 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1620 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1620 wrote to memory of 948 1620 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe 27 PID 1620 wrote to memory of 948 1620 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe 27 PID 1620 wrote to memory of 948 1620 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe 27 PID 1620 wrote to memory of 948 1620 5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe"C:\Users\Admin\AppData\Local\Temp\5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exeC:\Users\Admin\AppData\Local\Temp\5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2.exe"2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:948
-