Analysis
-
max time kernel
273s -
max time network
277s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
20-06-2024 14:31
Static task
static1
Behavioral task
behavioral1
Sample
637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe
Resource
win10-20240404-en
General
-
Target
637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe
-
Size
573KB
-
MD5
9f1c1e45b292299818c7fe64c865e67a
-
SHA1
1cce67a2b76d3bcd85f158f533e55296b8aea592
-
SHA256
637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983
-
SHA512
80eab29223eb6484f35b16582dcee4814d85f23ba8628ea273897afea72ba4c815850dd4ff1391e1f3b49de26fb0525031a56973c72870b4db68ba28a54da3e3
-
SSDEEP
6144:8KIpz8gbJnHlZB1wYvPgwi/YkVlWGGv5wVRU/rCPED3xTfuRkbjaRVepohAYHdGZ:BGz7JHsYKN2v5/G+TfuR1VioyYHjS
Malware Config
Extracted
C:\Program Files\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
Signatures
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Renames multiple (7677) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\akira_readme.txt 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 32 IoCs
description ioc Process File opened for modification C:\Users\Admin\Music\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Public\Videos\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Public\Music\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files (x86)\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Public\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Public\Documents\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Users\Admin\Links\desktop.ini 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.b010e8f2.pri 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-unplated.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-125.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-200.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\winsdkfb\Images\akira_readme.txt 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\next-arrow-hover.svg 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text-2x.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\akira_readme.txt 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close-2.svg 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\mn_16x11.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\en-gb\outlook_whatsnew.xml 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\akira_readme.txt 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\classic_1s.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\compare_poster.jpg 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OneConnectWideTile.scale-200.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-focus_32.svg 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\akira_readme.txt 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.scale-400.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-72_altform-unplated.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Sounds\SpeedLimitViolationAlert.wav 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\akira_readme.txt 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\akira_readme.txt 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-32.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe\akira_readme.txt 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\selector.js 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_DogEar.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1250_48x48x32.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe\AppxSignature.p7x 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\models\de-DE.mail.config 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Fues\green_button.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Icons.ttf 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\hr_60x42.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_scale-100.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\submission_history.gif 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-dark-focus_32.svg 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\193.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\favicon.ico 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-256_altform-unplated_contrast-white.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-256.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100_contrast-high.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\akira_readme.txt 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\en-US\msdaprsr.dll.mui 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.White.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File created C:\Program Files\VideoLAN\VLC\locale\et\akira_readme.txt 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\ProductPoseEstimation27Pts.mdl 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\TXP_Package.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-72.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-150_contrast-black.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\akira_readme.txt 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\akira_readme.txt 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\SmallTile.scale-125.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\akira_readme.txt 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-32_altform-unplated_contrast-white.png 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe 5048 637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe"C:\Users\Admin\AppData\Local\Temp\637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:5048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5bd14c24a37c4a8cf1d6cd63e5542ecca
SHA1c51a9b04bf15ac9749012cf2f9da55035996be90
SHA256962caf0607499b57a00e3f948279c4f200bc58b559705678d3756481c7426ba7
SHA5123a8ca142c9b8584a51f9cdb6bd15554bfce89ba9c4119b25da72d5f5b245d926f31fc9f04482e29af1485051b8500a7bec7c1b383439a9ec7dc8056a5a0630dd