resource	yara_rule
behavioral4/memory/5008-1-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-2-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-3-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-4-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-5-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-7-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-11-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-12-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-14-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-15-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-16-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-17-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-18-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-19-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-22-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-23-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-24-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-25-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-26-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-27-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-28-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-29-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-30-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-31-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-32-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-33-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-34-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-35-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-36-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-37-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-38-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-39-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-40-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-41-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-42-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-43-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-44-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-45-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-46-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-47-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-48-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-49-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-50-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-51-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-52-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-53-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-54-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-55-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-56-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-57-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-58-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-59-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-60-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-61-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-62-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-63-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-64-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-65-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-66-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-67-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-68-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-69-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-70-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral4/memory/5008-71-0x0000000000400000-0x0000000000608000-memory.dmp	upx

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-825860316-2493133627-3905166409-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	inf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	inf.exe

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-20_altform-unplated.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\ClippingTool.targetsize-20.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.targetsize-48_altform-lightunplated.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsWideTile.scale-100_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-150_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json	inf.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\Slider.js	inf.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DocumentCard\DocumentCardActivity.types.js	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\LockScreenLogo.scale-125_contrast-black.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-40_altform-unplated.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-white\GetHelpAppList.targetsize-36_altform-lightunplated_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-60_altform-unplated_contrast-black.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DetailsList\DetailsRow.base.js	inf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\ArchiveToastQuickAction.scale-80.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_altform-unplated_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SnipSketchAppList.targetsize-30_altform-lightunplated.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-60_altform-lightunplated.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\Dismiss.scale-80.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarWideTile.scale-125.png	inf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md	inf.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DocumentCard\DocumentCardActions.js	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-white\GetHelpSmallTile.scale-200_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\CameraSmallTile.scale-125.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-100_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\NewsLargeTile.scale-200_contrast-black.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib\transforms\rtlifyRules.js	inf.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DetailsList\DetailsRow.js	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-100.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailSmallTile.scale-150.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-lightunplated_contrast-black.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_altform-unplated_contrast-black.png	inf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.JPG	inf.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@fluentui\dom-utilities\lib-amd\getParent.js	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderStoreLogo.scale-125_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\CameraAppList.targetsize-30_altform-unplated.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesWideTile.scale-200_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireStoreLogo.scale-125.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\GetHelpWideTile.scale-125_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@fluentui\dom-utilities\lib-amd\getVirtualParent.js	inf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-40_altform-unplated.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-48_altform-lightunplated.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\Assets\Square44x44Logo.targetsize-32_altform-lightunplated.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Icons\StickyNotesWideTile.scale-125.png	inf.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	inf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA	inf.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\hoistStatics.js	inf.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Panel.js	inf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-256.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherAppList.targetsize-80_altform-unplated.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Icon.js	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\Assets\GameBar_AppList.targetsize-16_altform-unplated.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\8041_40x40x32.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-125_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-unplated_contrast-white.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\Images\FileForms32x32.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-200.png	inf.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DocumentCard\DocumentCard.types.js	inf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-256.png	inf.exe

description	pid	Process
Token: SeBackupPrivilege	4656	vssvc.exe
Token: SeRestorePrivilege	4656	vssvc.exe
Token: SeAuditPrivilege	4656	vssvc.exe
Token: SeShutdownPrivilege	1524	explorer.exe
Token: SeCreatePagefilePrivilege	1524	explorer.exe
Token: SeShutdownPrivilege	1524	explorer.exe
Token: SeCreatePagefilePrivilege	1524	explorer.exe
Token: SeShutdownPrivilege	1524	explorer.exe
Token: SeCreatePagefilePrivilege	1524	explorer.exe
Token: SeShutdownPrivilege	1524	explorer.exe
Token: SeCreatePagefilePrivilege	1524	explorer.exe
Token: SeShutdownPrivilege	1524	explorer.exe
Token: SeCreatePagefilePrivilege	1524	explorer.exe
Token: SeShutdownPrivilege	1524	explorer.exe
Token: SeCreatePagefilePrivilege	1524	explorer.exe

description	pid	Process	procid_target
PID 5008 wrote to memory of 3640	5008	inf.exe	79
PID 5008 wrote to memory of 3640	5008	inf.exe	79
PID 5008 wrote to memory of 1984	5008	inf.exe	83
PID 5008 wrote to memory of 1984	5008	inf.exe	83
PID 5008 wrote to memory of 1872	5008	inf.exe	85
PID 5008 wrote to memory of 1872	5008	inf.exe	85

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads