Analysis
-
max time kernel
91s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2022 02:33
Behavioral task
behavioral1
Sample
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe
Resource
win10v2004-20220901-en
General
-
Target
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe
-
Size
164KB
-
MD5
15039abc55ac99be0247c70d51482ed4
-
SHA1
f8c1169174ef77542c8951229e338a2dab3e54f8
-
SHA256
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d
-
SHA512
7c4da14da92e89dd8f06bc0f0a9ceaf490e479dd41192a4d0c69cbd60564546b559ea7852bb42f66eb505aa7b3c690ec6b3c736b2792b834e5072b6c9ffbe630
-
SSDEEP
3072:MLs3F0jdrUa3Z3TVixrZ2O1l6ZSOSVU2g//MdCglw5Euv1Ft5MM1o3u64DE:gQF0JIgZ3T0Z2aimHg//bglEN/IedD
Malware Config
Signatures
-
Detected Xorist Ransomware 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4920-138-0x0000000000400000-0x00000000004C2000-memory.dmp family_xorist behavioral2/memory/4920-139-0x0000000000400000-0x00000000004C2000-memory.dmp family_xorist behavioral2/memory/4920-140-0x0000000000400000-0x00000000004C2000-memory.dmp family_xorist behavioral2/memory/4920-141-0x0000000000400000-0x00000000004C2000-memory.dmp family_xorist behavioral2/memory/4920-142-0x0000000000400000-0x00000000004C2000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 1 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription ioc process File renamed C:\Users\Admin\Pictures\ExitUnprotect.png => C:\Users\Admin\Pictures\ExitUnprotect.png.fullcrypted 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Processes:
resource yara_rule behavioral2/memory/4060-132-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4920-134-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4060-135-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4920-137-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4920-138-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4920-139-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4920-140-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4920-141-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4920-142-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\34EeU833qyc18xe.exe" 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Drops file in System32 directory 16 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription ioc process File opened for modification C:\Windows\SysWOW64\@WirelessDisplayToast.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\DefaultAccountTile.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\MailContactsCalendarSync\LiveDomainList.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance_Error.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\@AppHelpToast.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\@AudioToastIcon.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsCodecsRaw.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\@EnrollmentToastIcon.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\@VpnToastIcon.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\Bthprops\@BthpropsNotificationLogo.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mmpbdegijlmoabdf.bmp" 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription pid process target process PID 4060 set thread context of 4920 4060 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Drops file in Program Files directory 64 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-60_altform-unplated.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-125.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black_devicefamily-colorfulunplated.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\Square150x150Logo.scale-200.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_contrast-white.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Dark.scale-150.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\MedTile.scale-125.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-black_scale-125.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-200_contrast-white.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Square150x150Logo.scale-125.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxAccountsLargeTile.scale-100.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-200.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-400.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\WideTile.scale-200.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-48.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-125_contrast-white.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-150_contrast-white.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-200_contrast-white.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_ie8.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-32.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-256.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-24_altform-unplated_contrast-white.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_altform-lightunplated.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-200.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_en_CA.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-24_altform-lightunplated.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxLargeTile.scale-100.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\WideTile.scale-200.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupMedTile.scale-100.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-64_altform-lightunplated.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40_altform-unplated_contrast-high.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.PNG 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-64_altform-unplated.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\WideTile.scale-200.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionLargeTile.scale-400.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteReplayCrossHairIcon-1.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-96_altform-lightunplated.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner-4x.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.GrayF.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-48.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\178.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-96.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlMiddleCircleHover.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-16_altform-colorize.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-unplated_contrast-black.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-125.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-200.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell-2x.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-100_contrast-black.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.scale-100.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-30_altform-unplated_contrast-white.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\music_offline_demo_page2.jpg 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tr.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_BadgeLogo.scale-100.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-48_altform-lightunplated.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-black_scale-200.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-48.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_hover.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Drops file in Windows directory 64 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription ioc process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSplashScreen.scale-400_contrast-black.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\PasswordExpiry.scale-400.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\RequestedDownloadsLargeCloudIcon.contrast-white_scale-150.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1258.TXT 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-white\AppListIcon.scale-400.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\WiFiNetworkManagerWarningToast.scale-150_contrast-black.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_delete.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare44x44.targetsize-96_altform-unplated.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\RequestedDownloadsCloudIcon.contrast-white_scale-400.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\PasswordExpiry.contrast-black_scale-400.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Square44x44Logo.targetsize-16_altform-unplated.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\disconnectIcon.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Square310x310Logo.contrast-white_scale-125.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.scale-400_contrast-black.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\PeopleLogo.scale-200_contrast-black.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.1_none_43fe9f4e368e081f\4.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\DropAccept.scale-300.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\RatingStars35.contrast-white_scale-200.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\Outlook.Theme-Light_Scale-200.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\500-14.htm 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\x86_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_10.0.19041.1_none_6fa7e5bbaa15a17d\topGradRepeat.jpg 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSplashScreen.scale-400.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\InputApp\Assets\SplashScreen.scale-200.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\Assets\KbdFunction.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\splashscreen.contrast-black_scale-100.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\eventTracepoint.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.targetsize-24_contrast-black.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\x86_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_10.0.19041.1_none_6fa7e5bbaa15a17d\selectedTab_1x1.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-64_contrast-black.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\storelogo.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Wide310x150Logo.contrast-white_scale-150.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.1_none_b719750f25d4cc37\SquareTile44x44.scale-100.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\RetailDemo\retailDemoAdvancedInclusive.html 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.targetsize-256_altform-unplated.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\Assets\WideLogo310x150.scale-400.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\foreground.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\PeopleLogo.targetsize-40_altform-unplated_contrast-white.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..in.assets.searchapp_31bf3856ad364e35_10.0.19041.1_none_501fda1ac26a3cf4\Splashscreen.contrast-white_scale-80.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\14.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\TinyTile.contrast-black_scale-400.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleLogo.scale-100_contrast-white.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\Globe.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare150x150Logo.scale-150_contrast-white.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\TabSweepExplanation.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\dockH.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare44x44.targetsize-20_altform-unplated.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\TileSmall.contrast-black_scale-125.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare71x71.scale-100_contrast-white.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\i_f12_context_chartselection_clear.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.1266_none_e8d910c7c702b558\@WindowsUpdateToastIcon.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\debugger\Breakpoints\images\eventTracepointDisabled.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\square44x44logo.scale-150_contrast-white.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\AddNewRuleIcon.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-black.searchapp_31bf3856ad364e35_10.0.19041.1_none_e479c512c8bfeb66\AppListIcon.targetsize-16_altform-unplated.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\Answer.scale-150.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\NearShare.scale-400.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\splashscreen.scale-400.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobecortana-main.html 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.1_none_aa1fc2e87b362d12\Registry Editor.lnk 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Ring03.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.19041.746_none_fa033ad7aa9be481\Speech Sleep.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\DefaultSystemNotification.contrast-white_scale-200.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\Assets\SquareLogo310x310.scale-200.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Modifies registry class 10 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\34EeU833qyc18xe.exe" 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.fullcrypted\ = "BYWWLWTPWPUCPSO" 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO\ = "CRYPTED!" 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\34EeU833qyc18xe.exe,0" 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO\shell\open\command 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO\shell\open 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fullcrypted 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO\DefaultIcon 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO\shell 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription pid process target process PID 4060 wrote to memory of 4920 4060 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe PID 4060 wrote to memory of 4920 4060 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe PID 4060 wrote to memory of 4920 4060 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe PID 4060 wrote to memory of 4920 4060 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe PID 4060 wrote to memory of 4920 4060 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe PID 4060 wrote to memory of 4920 4060 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe PID 4060 wrote to memory of 4920 4060 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe PID 4060 wrote to memory of 4920 4060 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe"C:\Users\Admin\AppData\Local\Temp\48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exeC:\Users\Admin\AppData\Local\Temp\48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe2⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:4920