globeimposter | 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920

Analysis

max time kernel
150s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-04-2023 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
Size

167KB
MD5

612974dcb49adef982d9ad8d9cbdde36
SHA1

b817e361bd0cc1819d7f6a1189f0f5d56ed48721
SHA256

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920
SHA512

84d5acbb8f258683bb6735539e368c2823218d2a6cf07222a50e1e026e3a0aca092941110e87b1d38a601c6a1e3d54604c2f4241c3ec265ed0bf25140a14c2fc
SSDEEP

3072:Vzm96ax+qLT5+IqRRztaWEmJLhSpTGqbay/0TwEz:VS96axL5kxHP0hmy/4z

Score

10^/10

globeimposter persistence ransomware spyware stealer

Malware Config

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ClearExport.raw => C:\Users\Admin\Pictures\ClearExport.raw..doc	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Pictures\EnterOut.tiff	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File renamed	C:\Users\Admin\Pictures\EnterOut.tiff => C:\Users\Admin\Pictures\EnterOut.tiff..doc	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Pictures\InstallSearch.tiff	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Pictures\JoinSwitch.tiff	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File renamed	C:\Users\Admin\Pictures\ResolveWrite.crw => C:\Users\Admin\Pictures\ResolveWrite.crw..doc	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File renamed	C:\Users\Admin\Pictures\InstallSearch.tiff => C:\Users\Admin\Pictures\InstallSearch.tiff..doc	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File renamed	C:\Users\Admin\Pictures\JoinSwitch.tiff => C:\Users\Admin\Pictures\JoinSwitch.tiff..doc	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File renamed	C:\Users\Admin\Pictures\MeasureComplete.raw => C:\Users\Admin\Pictures\MeasureComplete.raw..doc	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe"	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

Drops desktop.ini file(s) 29 IoCs

Processes:

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

Drops file in Program Files directory 64 IoCs

Processes:

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\MSTHED98.POC	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0186348.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic 2.xml	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00438_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382925.JPG	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\TWRECS.DLL	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Customer Support.fdt	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME20.CSS	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Essential.xml	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02389_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHighMask.bmp	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityMergeFax.Dotx	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\OFFISUPP.HTM	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTIRM.XML	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\VisioCustom.propdesc	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALSO98.POC	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATWIZ.POC	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImage.jpg	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDREQ.CFG	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR4B.GIF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02390_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\utilityfunctions.js	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME33.CSS	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME41.CSS	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01183_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\PRODIGY.NET.XML	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\TAB_OFF.GIF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00057_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01849_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00330_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\Read___ME.html	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\Read___ME.html	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PAPER_01.MID	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_COL.HXT	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21335_.GIF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0281904.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01149_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_hu.dll	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DigitalInk.jpg	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Metro.xml	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00145_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00076_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl.css	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLADD.FAE	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02134_.GIF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00915_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18191_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18206_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03466_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Module.zip	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\Read___ME.html	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IPDESIGN.DLL	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.SemiTrust.dll	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert.css	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0205462.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02085_.GIF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfo.zip	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL083.XML	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

pid	Process
1288	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

C:\Users\Admin\AppData\Local\Temp\13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
"C:\Users\Admin\AppData\Local\Temp\13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Videos\Sample Videos\Read___ME.html

Filesize
4KB

MD5
c23d0dc362feb929681b80ecbc32249a

SHA1
4d0839815f77ec716a0cad6e347f5cac7a316bb9

SHA256
d1c1e33cd522457d62aa0ad83a7aeac4d23e1bac42e3a50f86781fad3d9dc01e

SHA512
4f1b2fab0a626b8cd51c4f589b37f604d623725bb98fb1001ccc5bd93b962f0839a653e8aa2e6d5f2680c57e61a3866039533223324a4c178b70567f5cd0351b

Download Submit
memory/1288-757-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download