Analysis
-
max time kernel
150s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 03:28
Static task
static1
Behavioral task
behavioral1
Sample
173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe
Resource
win7-20220718-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe
-
Size
514KB
-
MD5
333692f4aa893a0f1c2f5e0fb6b23737
-
SHA1
5a951cf930941b88bf4dd250f37f178c4f94c5c1
-
SHA256
173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca
-
SHA512
5492f23abf615f62f7b1a43aef1713bb55ecc72d8aa9a0399d97b0f24f116bbf237962de894e9a014a7a13795843d8c1d42b599c89955fd5309270751284d631
Malware Config
Extracted
Path
C:\Restore-My-Files.txt
Ransom Note
All your files are Encrypted!
For data recovery needs decryptor.
How to buy decryptor:
----------------------------------------------------------------------------------------
| 1. Download Tor browser - https://www.torproject.org/ and install it.
| 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/
| 3. Follow the instructions on this page
----------------------------------------------------------------------------------------
Note! This link is available via "Tor Browser" only.
------------------------------------------------------------
Free decryption as guarantee.
Before paying you can send us 1 file for free decryption.
------------------------------------------------------------
alternate address - http://helpinfh6vj47ift.onion/
DO NOT CHANGE DATA BELOW
###s6dlsnhtjwbhr###�����������23 F7 AC E1 9A 4B 3F 88 31 26 5D A1 88 E8 AB 96
2B 38 F9 8C 66 04 BD B3 26 5C 60 ED F5 12 53 8C
EA EF 09 8A 76 22 2B 4E CF F9 DD A7 D9 45 3E 99
D1 F5 18 3F D2 69 00 8F FB E6 BD 68 73 53 07 69
D3 AB 34 E6 E2 FC 6A 70 06 81 B2 0D 9A E0 68 39
84 FE 97 39 51 FF F8 19 9D 92 B6 F8 FF 44 EC EA
F7 A7 18 0F E2 46 71 B7 80 22 EA 45 3C 2A AC 65
06 CD 19 1B D6 B5 31 9D 93 50 E0 20 63 2D 2A 80
69 B2 AD A3 FD 8A 57 59 33 2A 52 46 27 87 AA DA
44 7E 59 F4 79 82 F1 CA E4 FA 26 0B DC 80 17 07
1F 32 22 8C 3B F4 09 69 8D 8E 6E 24 68 E8 0D CC
AC 71 46 DE FE 64 5A F2 C8 D8 63 D7 B6 B8 CD DB
8F E5 5D 8D 8A B0 1B AE 4B 11 B3 3F 00 64 1E E8
D0 5A 8A 7A DF 46 1B 3A E6 15 3B 62 C7 D2 CD 9C
B6 50 E9 E5 F2 8D 38 FE D3 BB C0 3D 54 69 D7 B6
56 B5 7E CD A4 18 34 85 EB 8A 68 DD 42 64 FD 46
###�������������
URLs
http://decrmbgpvh6kvmti.onion/
http://helpinfh6vj47ift.onion/
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\SaveRegister.tiff 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File renamed C:\Users\Admin\Pictures\SaveRegister.tiff => C:\Users\Admin\Pictures\SaveRegister.tiff.DOCM 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File renamed C:\Users\Admin\Pictures\UnblockSelect.png => C:\Users\Admin\Pictures\UnblockSelect.png.DOCM 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe" 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe -
Drops desktop.ini file(s) 28 IoCs
description ioc Process File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Admin\Music\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Public\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Public\Documents\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Admin\Links\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Public\Music\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Public\Videos\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1672 set thread context of 888 1672 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe 28 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN082.XML 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue.css 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\Restore-My-Files.txt 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15132_.GIF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Executive.xml 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LTHD11.POC 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR28B.GIF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21337_.GIF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18227_.WMF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149118.JPG 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD.DEV_COL.HXT 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14867_.GIF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00361_.WMF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCOUPON.DPV 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR15F.GIF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBWZINT.REST.IDX_DLL 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBHED98.POC 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\IconImagesMask.bmp 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR44B.GIF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange.css 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.xml 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImagesMask.bmp 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14866_.GIF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105506.WMF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\form_edit.js 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImages.jpg 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONINTL.DLL.IDX_DLL 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Clarity.xml 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IMPMAIL.DLL 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSIDEBR.XML 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0186348.WMF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099167.JPG 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151581.WMF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBHD.XML 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Off.jpg 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\BUTTON.GIF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18198_.WMF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dataset.zip 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7FR.LEX 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14996_.GIF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Urban.xml 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00428_.WMF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianResume.Dotx 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSOUC.HXS 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00255_.WMF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00705_.WMF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\COUGH.WAV 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\TAB_ON.GIF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18214_.WMF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Slipstream.eftx 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\STRBRST.POC 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\BG_ADOBE.GIF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\TexturedBlue.css 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana.css 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\attention.gif 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR33F.GIF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Fancy.dotx 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00414_.WMF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00623_.WMF 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GROOVE.HXS 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL082.XML 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1672 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe 1672 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe 1672 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe 1672 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1672 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1672 wrote to memory of 888 1672 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe 28 PID 1672 wrote to memory of 888 1672 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe 28 PID 1672 wrote to memory of 888 1672 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe 28 PID 1672 wrote to memory of 888 1672 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe 28 PID 1672 wrote to memory of 888 1672 173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe"C:\Users\Admin\AppData\Local\Temp\173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe"C:\Users\Admin\AppData\Local\Temp\173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe"2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:888
-