Analysis
-
max time kernel
151s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-08-2022 10:30
Static task
static1
Behavioral task
behavioral1
Sample
21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe
-
Size
390KB
-
MD5
fec6f114419bfb3182ce771e7e4cd384
-
SHA1
c63f0ce447c63fe232e6ba45d259110f167d6746
-
SHA256
21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab
-
SHA512
27960a22c708990fcf3878d7a65ccea44bcea554c565d166d8df590dc36b9ab5c3229a73168cc8fe6ce3241b3732ab181ce44c3fb1144e4d63972d71b66f895e
-
SSDEEP
6144:B1iTvDacVTkrzy8FdikDUWrZJyTWZZDmehT4ZyPsr3YUkDMB2fukylSxpY0:Iu8KikDByT1ClylSx1
Score
10/10
Malware Config
Extracted
Path
C:\readme.txt
Family
globeimposter
Ransom Note
All your files are Encrypted!
For data recovery needs decryptor.
How to buy decryptor:
----------------------------------------------------------------------------------------
| 1. Download Tor browser - https://www.torproject.org/ and install it.
| 2. Open link in TOR browser - http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST4HYJUHGFV
| 3. Create Ticket
----------------------------------------------------------------------------------------
Note! This link is available via Tor Browser only.
------------------------------------------------------------
Your ID
���������1C 2B 4E 9D 2C 60 6C B8 CB 6E BF 8D FB F2 B8 98
03 11 05 CB C5 84 47 DC 49 E3 54 35 AB 08 DD 89
B1 43 EE E0 7D 8A 71 F4 CE 1C 76 7F D9 CD 85 EC
A4 23 3E 86 9C 6C 13 90 A9 90 F6 82 E4 FF 1D 14
E5 5F D2 D8 1C 1A B0 58 9D A6 B0 FD 56 8B 63 75
C6 37 AD 76 81 39 70 47 4C CF 4F F8 2E 0E 61 C5
A7 57 C0 14 2D 58 FD CE B6 C2 42 14 41 C0 06 3A
71 A1 42 86 68 85 25 B0 50 ED 8A D5 E1 51 ED FB
B6 90 77 77 7D B2 28 8B 0D B3 09 C2 C2 82 CC 16
6C D1 8B F3 42 6E F5 1F 9B 5B AE A4 07 DD 86 4F
27 E8 24 F0 EE AF 68 BC AB 65 A5 84 E0 3E AF E4
77 91 16 32 D3 BA A4 97 EC 89 A0 A5 E2 E9 BB A3
12 54 1D 37 FD 51 3B A3 15 A5 A6 1B C4 53 98 2A
3C 6E 44 78 73 02 AA 56 FB 21 61 2B 55 A2 6B 0D
F7 54 10 31 32 69 C1 EF C3 14 A5 87 82 D5 DA BE
80 F1 49 75 BE 77 A4 C4 1E 2D DF F8 8A F5 12 76
URLs
http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST4HYJUHGFV
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ApproveUnpublish.tiff => C:\Users\Admin\Pictures\ApproveUnpublish.tiff.r2u 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Pictures\EnableMerge.tiff 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File renamed C:\Users\Admin\Pictures\EnableMerge.tiff => C:\Users\Admin\Pictures\EnableMerge.tiff.r2u 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Pictures\PopSplit.tiff 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File renamed C:\Users\Admin\Pictures\PopSplit.tiff => C:\Users\Admin\Pictures\PopSplit.tiff.r2u 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File renamed C:\Users\Admin\Pictures\SendMove.raw => C:\Users\Admin\Pictures\SendMove.raw.r2u 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Pictures\ApproveUnpublish.tiff 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File renamed C:\Users\Admin\Pictures\ConvertFromRepair.raw => C:\Users\Admin\Pictures\ConvertFromRepair.raw.r2u 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File renamed C:\Users\Admin\Pictures\PingRestore.crw => C:\Users\Admin\Pictures\PingRestore.crw.r2u 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File renamed C:\Users\Admin\Pictures\ReceiveCompare.png => C:\Users\Admin\Pictures\ReceiveCompare.png.r2u 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File renamed C:\Users\Admin\Pictures\ResolveClear.tif => C:\Users\Admin\Pictures\ResolveClear.tif.r2u 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe" 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe -
Drops desktop.ini file(s) 29 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Music\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Public\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Public\Videos\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Public\Music\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Public\Documents\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Links\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1660 set thread context of 2008 1660 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe 27 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.HXS 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Elemental.xml 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Oriel.xml 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341344.JPG 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01358_.WMF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01255G.GIF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03425I.JPG 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\readme.txt 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\EMAILMOD.POC 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\NOTEL.ICO 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\TURABIAN.XSL 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Origin.xml 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\LATIN1.SHP 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Black Tie.xml 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00688_.WMF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImagesMask.bmp 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePageBlank.gif 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePage.html 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ReviewRouting_Review.xsn 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10307_.GIF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LTHD98SP.POC 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200383.WMF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Installed_schemas14.xss 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0186348.WMF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00369_.WMF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239191.WMF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\JAVA_01.MID 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00388_.WMF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImages.jpg 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115840.GIF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02810J.JPG 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielReport.Dotx 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid.gif 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUB6INTL.REST.IDX_DLL 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0281638.WMF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02265_.WMF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.lng 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\PersonalContact.ico 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL097.XML 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_COL.HXT 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0305257.WMF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02062U.BMP 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\UrbanFax.Dotx 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\readme.txt 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FLAP.WMF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CHIMES.WAV 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV.HXS 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14868_.GIF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341439.JPG 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00034_.WMF 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files\Windows Journal\fr-FR\Journal.exe.mui 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginDialogBackground.jpg 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts.css 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files\SearchSync.ppt 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe File opened for modification C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1660 wrote to memory of 2008 1660 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe 27 PID 1660 wrote to memory of 2008 1660 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe 27 PID 1660 wrote to memory of 2008 1660 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe 27 PID 1660 wrote to memory of 2008 1660 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe 27 PID 1660 wrote to memory of 2008 1660 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe 27 PID 1660 wrote to memory of 2008 1660 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe 27 PID 1660 wrote to memory of 2008 1660 21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe"C:\Users\Admin\AppData\Local\Temp\21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\21b38af989d3f5f3bf16e0a7562b5bdb4c544b49c0711b8f055b4fb61e242eab.exe"{path}"2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2008
-