Analysis
-
max time kernel
99s -
max time network
148s -
platform
windows7_x64 -
resource
win7v191014 -
submitted
11-02-2020 13:53
Static task
static1
Behavioral task
behavioral1
Sample
8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
Resource
win7v191014
Behavioral task
behavioral2
Sample
8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
Resource
win10v191014
General
-
Target
8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
-
Size
1.7MB
-
MD5
3f4181968baaf480a628d522c14cee75
-
SHA1
0cfbe9d8a205fa528c00c96253ff309ab666ee90
-
SHA256
8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351
-
SHA512
319332107b9da31aaa752dc75d5291c80668c204be2b6f0a3d31d4a48428bdccd5dcc7787678eb003fbb3d61af5245ea0d8c87b343cbaf77877e5f0c49e69db4
Malware Config
Signatures
-
Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
-
Executes dropped EXE 2 IoCs
Processes:
._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exeSynaptics.exepid process 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe 732 Synaptics.exe -
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\RenameUnregister.tiff ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe -
Drops startup file 1 IoCs
Processes:
._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe -
Loads dropped DLL 3 IoCs
Processes:
8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exepid process 1164 8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe 1164 8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe 1164 8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exedescription ioc process File opened for modification C:\Users\Admin\Music\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4RHK1DJ5\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Fonts\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Public\Downloads\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Media\Savanna\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\Cookies\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\Videos\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\CZUF3YTD\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Public\Pictures\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Public\Documents\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\Documents\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Public\Music\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Media\Quirky\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Media\Festival\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Globalization\MCT\MCT-US\Link\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BA8Z0IE6\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\assembly\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Media\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZQBF4MQS\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\$Recycle.Bin\S-1-5-21-1774239815-1814403401-2200974991-1000\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Media\Heritage\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Media\Characters\Desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F0PWNRM0\desktop.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
description flow ioc HTTP URL 7 http://www.sfml-dev.org/ip-provider.php -
Drops file in System32 directory 1 IoCs
Processes:
._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exedescription ioc process File opened for modification C:\Windows\SysWOW64\regedit.exe ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe -
Drops file in Program Files directory 64 IoCs
Processes:
._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exedescription ioc process File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_ja.properties.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BANNER.DPV ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_ring_docked.png ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239973.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\ImportLimit.rm.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0332268.WMF ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\ResourceInternal.zip ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0297269.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\LICENSE ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153514.WMF ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Windows Journal\Templates\blank.jtp ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187819.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18241_.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\WHOOSH.WAV ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Matamoros ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198020.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0102762.WMF ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCHDRESN.CFG ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Java\jre7\bin\jp2ssv.dll.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00394_.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\SUMIPNTG.INF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Inuvik.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Java\jre7\lib\zi\America\Miquelon.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART11.BDR ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00525_.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239951.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02749U.BMP.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Microsoft Office\Office14\1033\ACCVDTUI.DLL.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14532_.GIF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\J0115855.GIF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_settings.png ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00100_.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105638.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00077_.WMF ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01253_.GIF ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02897J.JPG.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PSTPRX32.DLL ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImages.jpg ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Windows Sidebar\sbdrop.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00685_.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[QU5SZ2XF79RLTP0].odveta ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libaudiobargraph_v_plugin.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe -
Drops file in Windows directory 64 IoCs
Processes:
._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\mdmti.inf ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Cursors\beam_m.cur ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Fonts\angsai.ttf ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Fonts\calibri.ttf ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\sisraid4.inf ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Media\Savanna\Windows User Account Control.wav ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\f3e56ef4494d5d7845ad4070fd599860\System.DirectoryServices.ni.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\agp.PNF ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Fonts\ebrimabd.ttf ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationTypes\1e1a1bd97e618bc4934ee967bea27ae8\UIAutomationTypes.ni.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Device\64b016e546f8d38525f02e9c73c559ea\System.Device.ni.dll.aux ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\usbport.PNF ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Fonts\msjhbd.ttf ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Fonts\seguisb.ttf ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Media\Windows Battery Low.wav ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\ehome\wow\ehuihlp.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\diagnostics\system\Performance\CL_Utility.ps1 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\ehome\en-US\ehrec.exe.mui ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\home2.aspx.resx ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\diagnostics\system\DeviceCenter\CL_Utility.ps1 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Media\Speech Sleep.wav ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Pipes\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.Pipes.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\3d01d2b7bde19d91d70c4ff96eea3432\PresentationFramework.ni.dll.aux ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.Data.Entity.targets ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualC.STLCLR.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Media\Quirky\Windows Ding.wav ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.Http.WebRequest.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Wind0de890be#\5bf4243eccd10a06c3d5086c8a884165\System.Windows.Forms.DataVisualization.ni.dll.aux ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Fonts\CALISTB.TTF ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Internals.aspx.resx ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.iTV.Media.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\mdmsmart.PNF ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\mdmusrgl.inf ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio49d6fefe#\f52bfe40c54917622ed3abb98db8f90a\PresentationFramework-SystemXml.ni.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\system.core.dll_amd64 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\mshdc.PNF ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\UninstallWebEventSqlProvider.sql ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xml.XmlSerializer.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\en-US\netavpna.inf_loc ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\netr28ux.inf ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\wiaep002.PNF ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Code\WizardPage.cs ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Fonts\angsaui.ttf ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\mdmc26a.inf ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\wceisvista.inf ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_en_31bf3856ad364e35\microsoft.tpm.resources.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ksc.nlp ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\c335a6ef5339fa917518475c286c8ca4\System.Data.Services.ni.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.9c7998a9#\acd902e709e971559dc5dcdc9b623b5b\System.Web.DynamicData.Design.ni.dll.aux ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\prngt004.PNF ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\diagnostics\system\Power\en-US\RS_AdjustDimDisplay.psd1 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Fonts\SCHLBKB.TTF ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\netb57va.inf ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\inf\.NET CLR Networking 4.0.0.0\001F\_Networkingperfcounters.ini ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\normnfkc.nlp ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.InteropServices.WindowsRuntime.dll ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exepid process 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.exedescription pid process target process PID 1164 wrote to memory of 832 1164 8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe PID 1164 wrote to memory of 832 1164 8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe PID 1164 wrote to memory of 832 1164 8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe PID 1164 wrote to memory of 832 1164 8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe PID 832 wrote to memory of 1632 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 1632 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 1632 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 1632 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 1632 wrote to memory of 1412 1632 cmd.exe net.exe PID 1632 wrote to memory of 1412 1632 cmd.exe net.exe PID 1632 wrote to memory of 1412 1632 cmd.exe net.exe PID 1632 wrote to memory of 1412 1632 cmd.exe net.exe PID 1412 wrote to memory of 1444 1412 net.exe net1.exe PID 1412 wrote to memory of 1444 1412 net.exe net1.exe PID 1412 wrote to memory of 1444 1412 net.exe net1.exe PID 1412 wrote to memory of 1444 1412 net.exe net1.exe PID 832 wrote to memory of 1452 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 1452 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 1452 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 1452 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 1452 wrote to memory of 1220 1452 cmd.exe net.exe PID 1452 wrote to memory of 1220 1452 cmd.exe net.exe PID 1452 wrote to memory of 1220 1452 cmd.exe net.exe PID 1452 wrote to memory of 1220 1452 cmd.exe net.exe PID 1220 wrote to memory of 1420 1220 net.exe net1.exe PID 1220 wrote to memory of 1420 1220 net.exe net1.exe PID 1220 wrote to memory of 1420 1220 net.exe net1.exe PID 1220 wrote to memory of 1420 1220 net.exe net1.exe PID 832 wrote to memory of 736 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 736 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 736 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 736 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 736 wrote to memory of 1732 736 cmd.exe net.exe PID 736 wrote to memory of 1732 736 cmd.exe net.exe PID 736 wrote to memory of 1732 736 cmd.exe net.exe PID 736 wrote to memory of 1732 736 cmd.exe net.exe PID 1732 wrote to memory of 1056 1732 net.exe net1.exe PID 1732 wrote to memory of 1056 1732 net.exe net1.exe PID 1732 wrote to memory of 1056 1732 net.exe net1.exe PID 1732 wrote to memory of 1056 1732 net.exe net1.exe PID 832 wrote to memory of 1084 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 1084 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 1084 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 1084 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 1084 wrote to memory of 1108 1084 cmd.exe net.exe PID 1084 wrote to memory of 1108 1084 cmd.exe net.exe PID 1084 wrote to memory of 1108 1084 cmd.exe net.exe PID 1084 wrote to memory of 1108 1084 cmd.exe net.exe PID 1108 wrote to memory of 1332 1108 net.exe net1.exe PID 1108 wrote to memory of 1332 1108 net.exe net1.exe PID 1108 wrote to memory of 1332 1108 net.exe net1.exe PID 1108 wrote to memory of 1332 1108 net.exe net1.exe PID 832 wrote to memory of 1492 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 1492 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 1492 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 832 wrote to memory of 1492 832 ._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe cmd.exe PID 1492 wrote to memory of 1880 1492 cmd.exe net.exe PID 1492 wrote to memory of 1880 1492 cmd.exe net.exe PID 1492 wrote to memory of 1880 1492 cmd.exe net.exe PID 1492 wrote to memory of 1880 1492 cmd.exe net.exe PID 1880 wrote to memory of 1444 1880 net.exe net1.exe PID 1880 wrote to memory of 1444 1880 net.exe net1.exe PID 1880 wrote to memory of 1444 1880 net.exe net1.exe PID 1880 wrote to memory of 1444 1880 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe"C:\Users\Admin\AppData\Local\Temp\8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe"C:\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLWriter3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLBrowser3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$CONTOSO14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$CONTOSO15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSDTC3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSDTC4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSDTC5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT3⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER3⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop vds3⤵
-
C:\Windows\SysWOW64\net.exenet stop vds4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vds5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable4⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
06fdd27742bc4dcb30bc348fa0c24041
SHA1532db4b18a787d4d6a7e48f0b43c51210312f82b
SHA2565aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8
SHA512ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722
-
C:\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exeMD5
934984b11e6690c10e7ad5bf1f0cf274
SHA15c826f0bca1460508b0a3db4b0e5f9fbd7c2104f
SHA25695a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e
SHA5124cc96789b2c6a40b94d7dc5d3ed11876dc643172211114ee588bfc0988f00cc3508d0d1e5d39a08e29b003f12429ba46fa07ac58402d6838b7263a640b20f13e
-
\ProgramData\Synaptics\Synaptics.exeMD5
06fdd27742bc4dcb30bc348fa0c24041
SHA1532db4b18a787d4d6a7e48f0b43c51210312f82b
SHA2565aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8
SHA512ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722
-
\ProgramData\Synaptics\Synaptics.exeMD5
06fdd27742bc4dcb30bc348fa0c24041
SHA1532db4b18a787d4d6a7e48f0b43c51210312f82b
SHA2565aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8
SHA512ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722
-
\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exeMD5
934984b11e6690c10e7ad5bf1f0cf274
SHA15c826f0bca1460508b0a3db4b0e5f9fbd7c2104f
SHA25695a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e
SHA5124cc96789b2c6a40b94d7dc5d3ed11876dc643172211114ee588bfc0988f00cc3508d0d1e5d39a08e29b003f12429ba46fa07ac58402d6838b7263a640b20f13e
-
memory/832-5-0x0000000000E80000-0x0000000000E91000-memory.dmpFilesize
68KB
-
memory/832-7-0x0000000000E80000-0x0000000000E91000-memory.dmpFilesize
68KB
-
memory/832-6-0x0000000001290000-0x00000000012A1000-memory.dmpFilesize
68KB