Analysis
-
max time kernel
141s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
07-06-2024 18:35
Behavioral task
behavioral1
Sample
VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
General
-
Target
VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe
-
Size
512KB
-
MD5
e9fb9aa84d4dce3fb2f842e55d072394
-
SHA1
208dbcb50407f40915e063a4688ad32164925634
-
SHA256
5d9b22e6ad1984c921cec4782695ced92fedb029fdc9a54251e006c97c734a5e
-
SHA512
2c7a95d188d0b3aeb944b4fa4a24da0dbec97c336f819a8554c14e6a3a6498c3a77f3bda50a46853aa4e3addf62f8a1e3e8051b09d32f3351927dcc70da3e544
-
SSDEEP
12288:aFX5C2MBw0BVwSyG/XgWU5KZDGBvQYOGaKW22RmWveNoS1:axb4NtgWUgZ6Bv5BW225
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3156-1-0x0000000000400000-0x000000000057C000-memory.dmp upx behavioral2/memory/3156-2-0x0000000000400000-0x000000000057C000-memory.dmp upx behavioral2/memory/3156-3-0x0000000000400000-0x000000000057C000-memory.dmp upx behavioral2/memory/3156-5-0x0000000000400000-0x000000000057C000-memory.dmp upx behavioral2/memory/3156-6-0x0000000000400000-0x000000000057C000-memory.dmp upx behavioral2/memory/3156-7-0x0000000000400000-0x000000000057C000-memory.dmp upx behavioral2/memory/3156-8-0x0000000000400000-0x000000000057C000-memory.dmp upx behavioral2/memory/3156-9-0x0000000000400000-0x000000000057C000-memory.dmp upx behavioral2/memory/3156-10-0x0000000000400000-0x000000000057C000-memory.dmp upx behavioral2/memory/3156-11-0x0000000000400000-0x000000000057C000-memory.dmp upx behavioral2/memory/3156-12-0x0000000000400000-0x000000000057C000-memory.dmp upx behavioral2/memory/3156-13-0x0000000000400000-0x000000000057C000-memory.dmp upx behavioral2/memory/3156-14-0x0000000000400000-0x000000000057C000-memory.dmp upx behavioral2/memory/3156-15-0x0000000000400000-0x000000000057C000-memory.dmp upx behavioral2/memory/3156-16-0x0000000000400000-0x000000000057C000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\sc.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\TsWpfWrp.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\Utilman.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\icacls.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\msdt.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\rasdial.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\setup16.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\BackgroundTransferHost.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\dplaysvr.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\fsutil.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\unlodctr.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\bootcfg.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\GamePanel.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\ttdinject.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\winrs.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\recover.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\netsh.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\relog.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp_isv.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\appidtel.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\ndadmin.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\WerFaultSecure.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\msra.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\RpcPing.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesComputerName.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\TokenBrokerCookies.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\TpmInit.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\eudcedit.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\fixmapi.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\GameBarPresenceWriter.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\odbcconf.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\SyncHost.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\CredentialUIBroker.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\LaunchTM.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\net1.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\regsvr32.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\tttracer.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\Dism\DismHost.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setup.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\shutdown.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\fsquirt.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\NETSTAT.EXE VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\scrnsave.scr VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\dtdump.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\wlanext.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\setupugc.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\timeout.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\LaunchWinApp.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\psr.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\7-Zip\7zG.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\7-Zip\7z.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1_none_2d89ee37314a19a9\cleanmgr.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\r\VmComputeAgent.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.19041.1_none_c61fe93bf0d70d90\netcfg.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\f\spaceman.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1_none_a353adcda7cf69e6\convertvhd.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15805.0_none_f0aa60ae9c531752\CasPol.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.19041.1_none_ac65d58626f4027c\efsui.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.1_none_248d91ddf4389abd\CredentialUIBroker.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_6f27e9e1e7c4fb87\net1.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\r\hcsdiag.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_7777dd52093f9dd6\control.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.19041.746_none_86e29cecb9edce01\r\alg.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_f15a0c837b51c5fc\gpupdate.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1_none_db40687413b90853\wmlaunch.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\doskey.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.1_none_37ab35f7e4b21a45\PrintBrmEngine.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_aee92417063babbe\r\WinRTNetMUAHostServer.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4478665ed379a3fc\AtBroker.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_8636783e05df6f4e\newdev.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.844_none_9b62a70f9278f2cd\f\ofdeploy.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.1_none_18b14c7d1478d4cc\sethc.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\f\powershell.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.1_none_9fbebf8222c20a6d\uwfux.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.1266_none_d92abf553d8a282c\r\MusNotification.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.844_none_de5d9fe254d9f8c4\r\BioEnrollmentHost.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.1_none_eadb9d8875f59863\dllhost.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.264_none_51891893184281d8\LaunchWinApp.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\r\unsecapp.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.928_none_0f531ea0d233243b\f\DiagnosticsHub.StandardCollector.Service.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-proquota_31bf3856ad364e35_10.0.19041.1_none_ddb8055b31c2ae64\proquota.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.844_none_ef8661e4d6535c5c\TabTip.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.19041.746_none_d1f5ce67827e350f\mtstocom.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\iissetup.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.423_none_df344b9fe5390f25\f\AppResolverUX.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\wslconfig.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.1_none_d9d36ad7f915f657\fltMC.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3fb851095cc978d4\r\wmprph.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\bfsvc.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_2d0e4759c01cf211\f\setup_wm.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\r\vmms.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVDllSurrogate.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_b12cf6d951bfadc2\StartMenuExperienceHost.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.1_none_96907e39a64a62d0\mmgaserver.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\HelpPane.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..microsoftedgebchost_31bf3856ad364e35_10.0.19041.1_none_14b1d8fa41ae50fb\MicrosoftEdgeBCHost.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.19041.746_none_18c3ddf7dbfedda0\f\PinEnrollmentBroker.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\LsaIso.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.19041.1_none_f28c973357fcbd08\IMEWDBLD.EXE VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15805.0_none_51acbceed0728359\cvtres.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_dc7caa836f08ad57\regedit.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\f\conhost.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.423_none_15f557c171018574\f\CHXSmartScreen.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\SearchFilterHost.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.19041.1_none_fa551ac355d48c7f\fontview.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.746_none_72f50b15ab3c2aeb\f\ProximityUxHost.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\systemreset.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\r\aspnetca.exe VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.19041.1_none_a18558d9ae23205d\scrnsave.scr VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3156 VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe 3156 VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe 3156 VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_e9fb9aa84d4dce3fb2f842e55d072394.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3156