Analysis
-
max time kernel
102s -
resource
win10v191014 -
submitted
09/01/2020, 09:56
Task
task1
Sample
d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe
Resource
win10v191014
0 signatures
General
-
Target
d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9
-
Sample
200109-45gp759tgn
-
SHA256
d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9
Score
4/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4980 d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe -
Drops desktop.ini 46 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Admin\Links\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Admin\Music\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Public\Downloads\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Public\Libraries\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Public\Music\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Admin\Contacts\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Admin\Pictures\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Public\Documents\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Admin\Downloads\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Admin\Saved Games\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Admin\Searches\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Public\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Public\Pictures\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Public\Pictures\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-634046074-2673730973-2644684987-1000\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Admin\Documents\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Admin\Searches\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Admin\Links\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Public\Videos\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Admin\Pictures\Saved Pictures\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Admin\Videos\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Public\Downloads\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Public\Music\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Admin\OneDrive\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Admin\Favorites\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Admin\Favorites\Links\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Admin\Music\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Admin\Videos\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Public\Libraries\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Public\Videos\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\$Recycle.Bin\S-1-5-21-634046074-2673730973-2644684987-1000\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Public\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Public\AccountPictures\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Users\Public\Documents\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File deleted C:\Users\Admin\Pictures\Camera Roll\desktop.ini d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\ClopReadMe.txt d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe File opened for modification C:\Program Files (x86)\ClopReadMe.txt d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ClopReadMe.txt d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe"C:\Users\Admin\AppData\Local\Temp\d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Drops desktop.ini
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4980