Analysis
-
max time kernel
158s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2022 07:31
Behavioral task
behavioral1
Sample
8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe
Resource
win10v2004-20220812-en
General
-
Target
8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe
-
Size
7KB
-
MD5
a285e1529b2c97577e6f8b4507e745c8
-
SHA1
d4291f7ecb371beb3ac0c35876b68156aac392f8
-
SHA256
8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143
-
SHA512
164c1529b3c9fb973013c37de9581c4d1aeacfa93314bffaf4d9de1341b187717da248e1e68b5907ed98c9f8c7fb84062610451e3c1d7d7930c6f746c5d96cdf
-
SSDEEP
192:Ozdrr1FG1WDCgmjPZY/mPaT7EWf7lK8hU0MUA:Oprr1gkDCgSeuyvdlK8hPMB
Malware Config
Signatures
-
Detected Xorist Ransomware 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4824-133-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 1 IoCs
Processes:
8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exedescription ioc process File renamed C:\Users\Admin\Pictures\NewUse.png => C:\Users\Admin\Pictures\NewUse.png.EnCiPhErEd 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File renamed C:\Users\Admin\Pictures\ReadUninstall.png => C:\Users\Admin\Pictures\ReadUninstall.png.EnCiPhErEd 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File renamed C:\Users\Admin\Pictures\TraceCopy.png => C:\Users\Admin\Pictures\TraceCopy.png.EnCiPhErEd 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe -
Processes:
resource yara_rule behavioral2/memory/4824-132-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/4824-133-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3esHJguC1b6taym.exe" 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe -
Drops file in System32 directory 21 IoCs
Processes:
8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exedescription ioc process File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance_Error.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\DefaultAccountTile.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\@VpnToastIcon.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\Bthprops\@BthpropsNotificationLogo.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\MailContactsCalendarSync\LiveDomainList.txt 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\default.help.txt 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\@AppHelpToast.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\@EnrollmentToastIcon.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\@AudioToastIcon.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\@WirelessDisplayToast.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\WindowsCodecsRaw.txt 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe -
Drops file in Program Files directory 64 IoCs
Processes:
8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-150_contrast-black.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20_altform-unplated.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-lightunplated.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\PREVIEW.GIF 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-125_contrast-black.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\LockScreenLogo.scale-100.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-16_contrast-white.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.scale-200.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_altform-unplated.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-100_contrast-black.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-32_altform-unplated.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomSetupDisambig_RoomScale.jpg 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-30.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-300.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-32.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_contrast-white.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteSmallTile.scale-125.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-16.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_ie8.gif 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-125.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_altform-unplated.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-125.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-unplated.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-125_contrast-white.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-40_altform-unplated_contrast-black.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSmallTile.scale-150.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-400.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupLargeTile.scale-125.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionLargeTile.scale-400.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-100.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.scale-100.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-400.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-30_altform-unplated.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteSmallTile.scale-125.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\EmptyVideoProjectCreations_DarkTheme.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40_contrast-high.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\15.jpg 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\MilitaryLeft.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-125.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-96_altform-unplated_contrast-black.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\landing_page_start_a_coversation_v1.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeSmallTile.scale-400.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSmallTile.scale-100.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.contrast-black_scale-100.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\20.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-100_contrast-black.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\1.jpg 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-100.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteWideTile.scale-100.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-32.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubWideTile.scale-100_contrast-black.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.scale-200_contrast-white.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\MedTile.scale-125.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-48_altform-unplated.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-32.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-white_scale-100.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\WideTile.scale-100.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\LargeTile.scale-200.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\162.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-200_contrast-black.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-40.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_messages.targetsize-48.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe -
Drops file in Windows directory 64 IoCs
Processes:
8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exedescription ioc process File opened for modification C:\Windows\ImmersiveControlPanel\images\wide.Extras.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\Media\Ring07.wav 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\debugger\LanguageService\images\clearResults.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare150x150Logo.scale-150.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemResources\Windows.UI.Search\Images\logo.contrast-black_scale-80.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.scale-100.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemResources\Windows.UI.Shell\Images\RequestedDownloadsLargeCloudIcon.contrast-black_scale-125.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\perftools\images\i_save.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\dom\images\i_error.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\header\Images\headerclose.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\http_410.htm 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\RetailDemo\retailDemoSecurityInclusive.html 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\Assets\SquareTile44x44.targetsize-48_altform-unplated_devicefamily-colorfulunplated.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-white_scale-125.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\Assets\SplashScreen.Theme-Light_Scale-180.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\storage\images\cookies.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\view\oobeFooterHost.html 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\views\helloEnrollment.html 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Images\SmallLogo.scale-100.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\PasswordExpiry.scale-150.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Splashscreen.scale-150_contrast-white.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\WideTile.scale-125.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\22.txt 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\wide.AppsRtl.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\images\debuggerPrevTab.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\Assets\SplashScreen.scale-100.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\SmallTile.scale-200.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\Assets\SquareTile44x44.targetsize-256_altform-unplated_contrast-black_devicefamily-colorfulunplated.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare150x150Logo.scale-200.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.targetsize-256_altform-unplated_contrast-white.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\13.txt 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\views\localAccount.html 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Wide310x150Logo.scale-400.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\Assets\SquareLogo44x44.scale-400.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\Assets\StoreLogo.scale-400.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\Media\Speech Sleep.wav 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-80_altform-unplated.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\BadgeLogo.contrast-black_scale-100.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Experiences\PreInstalledApps\DefaultSquareTileLogo1.scale-80.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.scale-125.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.scale-125_altform-unplated.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\TinyTile.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\images\toggleWordWrap.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\header\Images\NavOverFlow_Start.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\es-ES\assets\ErrorPages\WpcBlockFrame.htm 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.targetsize-256_altform-unplated.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\Answer.scale-125.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\Media\Alarm10.wav 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Assets\Square44x44Logo.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\debugger\Breakpoints\images\eventBreakpointUnbound.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\debugger\LanguageService\images\unpin.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\square150x150logo.scale-400_contrast-white.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\RatingStars46.scale-200.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\header\Images\console.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobenetworklossaversion-main.html 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\SystemResources\Windows.UI.Search\Images\logo.scale-80.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\wide.DefaultPinTile.png 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe -
Modifies registry class 10 IoCs
Processes:
8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FJEEQNHUJJIAAHT 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FJEEQNHUJJIAAHT\ = "CRYPTED!" 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FJEEQNHUJJIAAHT\DefaultIcon 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FJEEQNHUJJIAAHT\shell\open\command 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FJEEQNHUJJIAAHT\shell 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "FJEEQNHUJJIAAHT" 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FJEEQNHUJJIAAHT\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3esHJguC1b6taym.exe,0" 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FJEEQNHUJJIAAHT\shell\open 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FJEEQNHUJJIAAHT\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3esHJguC1b6taym.exe" 8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe"C:\Users\Admin\AppData\Local\Temp\8562e60178ec470e8147d73130a93f2f568264048685dfc8a6258ac79f96d143.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:4824