Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-11-2022 16:17
Behavioral task
behavioral1
Sample
a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe
Resource
win10v2004-20220812-en
General
-
Target
a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe
-
Size
7KB
-
MD5
0fbf8c91afd09939c5ad7edc5ebb3c62
-
SHA1
a13a0edaf4b9619d594ea661f210d398bb48ff9e
-
SHA256
a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c
-
SHA512
8fb679351d55c7af5a592f5532d004a827d04ae14c42b25726402876428ff50a679656ed845a8b8d661952af9ad1da76497598a7bfc58e02dd769907c50cff40
-
SSDEEP
192:Cxzdrr1FG1WDCgmjPZUCFiwmNVlxGMUA:sprr1gkDCgS9FiwcAMB
Malware Config
Signatures
-
Detected Xorist Ransomware 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4900-133-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Processes:
resource yara_rule behavioral2/memory/4900-132-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/4900-133-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\t5Igu5hV8iEnx0k.exe" a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe -
Drops file in Program Files directory 64 IoCs
Processes:
a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exedescription ioc process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-40.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-80_altform-unplated.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\ImagePlaceholderBlack.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-32_altform-unplated.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-100_contrast-black.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailMediumTile.scale-100.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Sun.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-100_contrast-black.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in-2x.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.scale-200.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File created C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-100_contrast-white.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailMediumTile.scale-400.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsMedTile.scale-200.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\LargeTile.scale-200.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-100.HCBlack.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Light.scale-250.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100_contrast-white.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200_contrast-high.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_hover.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_BadgeLogo.scale-100.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileMediumSquare.scale-200.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-200_contrast-white.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square44x44Logo.scale-125.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-36.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File created C:\Program Files\Common Files\System\Ole DB\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\LockScreenLogo.scale-125.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-400.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Dark.scale-100.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailMediumTile.scale-150.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-60_altform-lightunplated.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20_altform-unplated_contrast-black.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer3Sec.targetsize-20.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\StopReproTraceIcon-glyph-e916.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7cb.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\README.md a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-400_contrast-white.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-80_altform-unplated.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File created C:\Program Files\Windows Media Player\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteSmallTile.scale-400.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Google.scale-250.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCache.scale-100.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256_altform-unplated_devicefamily-colorfulunplated.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\SearchEmail.png a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe File opened for modification C:\Program Files\7-Zip\License.txt a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe -
Modifies registry class 10 IoCs
Processes:
a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "KDURWVJJQCGUFCX" a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDURWVJJQCGUFCX\ = "CRYPTED!" a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDURWVJJQCGUFCX\DefaultIcon a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDURWVJJQCGUFCX\shell\open\command a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDURWVJJQCGUFCX\shell\open a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDURWVJJQCGUFCX\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\t5Igu5hV8iEnx0k.exe" a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDURWVJJQCGUFCX a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDURWVJJQCGUFCX\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\t5Igu5hV8iEnx0k.exe,0" a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDURWVJJQCGUFCX\shell a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe"C:\Users\Admin\AppData\Local\Temp\a3ab525165a12084496992acc2e98b6acab1d89ec60f40faac5103090b0c9d6c.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
PID:4900