ouroboros | 8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351

Analysis

max time kernel
59s
max time network
147s
platform
windows7_x64
resource
win7
submitted
17-09-2020 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
Size

1.7MB
MD5

3f4181968baaf480a628d522c14cee75
SHA1

0cfbe9d8a205fa528c00c96253ff309ab666ee90
SHA256

8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351
SHA512

319332107b9da31aaa752dc75d5291c80668c204be2b6f0a3d31d4a48428bdccd5dcc7787678eb003fbb3d61af5245ea0d8c87b343cbaf77877e5f0c49e69db4

Score

10^/10

ouroboros xmrig evasion macro miner persistence ransomware spyware

Malware Config

Signatures

Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
ransomware ouroboros
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Executes dropped EXE 2 IoCs

Processes:

._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exeSynaptics.exe

pid	Process
1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
1816	Synaptics.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\GrantFormat.tiff	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

Suspicious Office macro 2 IoCs

Office document equipped with macros.

macro

Processes:

resource	yara_rule
behavioral1/files/0x00030000000131cf-24.dat	office_macros
behavioral1/files/0x000400000001310d-62.dat	office_macros

Drops startup file 1 IoCs

Processes:

._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

Loads dropped DLL 3 IoCs

Processes:

8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

pid	Process
1100	8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
1100	8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
1100	8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

description	ioc	Process
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TGVUK4BG\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V8SX06NR\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File created	C:\Program Files\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File created	C:\$Recycle.Bin\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\Cookies\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZMLBLRQ7\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GVV7BJHB\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Public\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OLSU73OI\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

description	flow	ioc
HTTP URL	4	http://www.sfml-dev.org/ip-provider.php

Drops file in System32 directory 1 IoCs

Processes:

._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\regedit.exe	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

Drops file in Program Files directory 64 IoCs

Processes:

._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Paper.eftx	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingEngine.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN054.XML	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOCFU.DLL.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\Microsoft.Synchronization.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0196164.WMF	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\form_edit.js	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_settings.png	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.ITS	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0234376.WMF	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0234000.WMF	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099165.JPG	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\flyout.css	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net_1.2.200.v20140124-2013.jar	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Belem	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MORPH9.DLL	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile16.png	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01246_.GIF	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGLOGO.XML	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File created	C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHigh.jpg	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\he.pak	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libgme_plugin.dll.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0238333.WMF	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\EMAILMOD.POC	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)redStateIcon.png	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\BLUECALM.ELM.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\CAGCAT10.DLL	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21331_.GIF	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_over.png	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382961.JPG	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03795_.WMF	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\PICTPH.POC	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar.Email=[[email protected]]ID=[8RXBWPG56M34ILK].odveta	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

Drops file in Windows directory 64 IoCs

Processes:

._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

description	ioc	Process
File opened for modification	C:\Windows\mib.bin	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Security.#\267f03b78a9514be8c1ebd278f03e3ff\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V4381984f#\fa89de41d02d50c875d6699cfe070f20\Microsoft.VisualBasic.Compatibility.Data.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\e7b8df5d803bb9bd27f63f0074775aaf\Microsoft.MediaCenter.UI.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\naphlpr\3905ee11acabb6d202a69b8bfa3c91a0\naphlpr.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\napsnap\f64692e58aa1a7116024bf3c3cbd1352\napsnap.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Graph.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.SmartTag.config	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\TaskScheduler\a3883e7fc1bd0fbc54761b26c2bc5483\TaskScheduler.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Iden1fe87377#\2a8d6efe5a99d9e6b03587df841c2087\System.IdentityModel.Services.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\9c17882ea083259c36cfd691f7c0835b\System.Messaging.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiwmp\9f570489c98c93a79f0fd793586afdc6\ehiwmp.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\twunk_32.exe	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.iTV.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.11.0.office\14.0.0.0__71e9bce111e9429c\Policy.11.0.Office.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\Accessibility\b03641c39929ad202f0c3a9a64b93d86\Accessibility.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\MSBuild.ni.exe	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c968d57#\5685d6d6ada98c8dc25bb505e6421fd1\PresentationFramework.Luna.ni.dll.aux	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Wind412bbddf#\dac48ed7852587d900eb9e2eb8fdf32b\System.Windows.Controls.Ribbon.ni.dll.aux	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\System.WorkflowServices.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\dfsvc\261c09179eae03d67c9b6f3e70b603bd\dfsvc.ni.exe.aux	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\a7a48457faaea5fc8a1e59b4921ac4a3\SMDiagnostics.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf293040f3a93afa1ea782487acae816\WindowsBase.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\BDATunePIA\13385391832b7c36af9306baeb570e57\BDATunePIA.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\cd03f9386e02f56502e01a25ddd7e0a7\System.Configuration.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\AuditPolicyGPManagedStubs.Interop.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\normnfkd.nlp	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Word.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Graph.config	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Data\accc3a5269658c8c47fe3e402ac4ac1c\System.Data.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Entity\831aa231315a31ed3efeba1feb3bb936\System.Data.Entity.ni.dll.aux	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ehiTVMSMusic\6.1.0.0__31bf3856ad364e35\ehiTVMSMusic.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.AddI3d71a354#\d8c41b9b493fc289758fc3f7f094df61\System.AddIn.Contract.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\MiguiControls\1.0.0.0__31bf3856ad364e35\MIGUIControls.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Runtime.Remo#\0fde44651bdf14a3988b955dd94aa318\System.Runtime.Remoting.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\2bd538d545e15452202ef3b41080e2ce\ComSvcConfig.ni.exe	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web\7c32e936a07e0c7d9cae3ac27497f613\System.Web.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.Ink.config	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data16016462#\e9321ea18d8469f2adca065fe0651379\System.Data.Services.Design.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.BusinessData\14.0.0.0__71e9bce111e9429c\Microsoft.BusinessData.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Security.Resources.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Web.Entity\3.5.0.0__b77a5c561934e089\System.Web.Entity.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Web.Extensio#\e2d043bbce0d8d303dadd068037c3ffb\System.Web.Extensions.ni.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.ApplicationId.RuleWizard.Resources.dll	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid	Process
1612	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

pid	Process
1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

EXCEL.EXE

pid	Process
1612	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exe

description	pid	Process	procid_target
PID 1100 wrote to memory of 1516	1100	8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	25
PID 1100 wrote to memory of 1516	1100	8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	25
PID 1100 wrote to memory of 1516	1100	8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	25
PID 1100 wrote to memory of 1516	1100	8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	25
PID 1516 wrote to memory of 1364	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	27
PID 1516 wrote to memory of 1364	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	27
PID 1516 wrote to memory of 1364	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	27
PID 1516 wrote to memory of 1364	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	27
PID 1364 wrote to memory of 1312	1364	cmd.exe	29
PID 1364 wrote to memory of 1312	1364	cmd.exe	29
PID 1364 wrote to memory of 1312	1364	cmd.exe	29
PID 1364 wrote to memory of 1312	1364	cmd.exe	29
PID 1100 wrote to memory of 1816	1100	8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	30
PID 1100 wrote to memory of 1816	1100	8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	30
PID 1100 wrote to memory of 1816	1100	8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	30
PID 1100 wrote to memory of 1816	1100	8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	30
PID 1312 wrote to memory of 1824	1312	net.exe	31
PID 1312 wrote to memory of 1824	1312	net.exe	31
PID 1312 wrote to memory of 1824	1312	net.exe	31
PID 1312 wrote to memory of 1824	1312	net.exe	31
PID 1516 wrote to memory of 1716	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	32
PID 1516 wrote to memory of 1716	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	32
PID 1516 wrote to memory of 1716	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	32
PID 1516 wrote to memory of 1716	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	32
PID 1716 wrote to memory of 1584	1716	cmd.exe	34
PID 1716 wrote to memory of 1584	1716	cmd.exe	34
PID 1716 wrote to memory of 1584	1716	cmd.exe	34
PID 1716 wrote to memory of 1584	1716	cmd.exe	34
PID 1584 wrote to memory of 1624	1584	net.exe	35
PID 1584 wrote to memory of 1624	1584	net.exe	35
PID 1584 wrote to memory of 1624	1584	net.exe	35
PID 1584 wrote to memory of 1624	1584	net.exe	35
PID 1516 wrote to memory of 1540	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	37
PID 1516 wrote to memory of 1540	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	37
PID 1516 wrote to memory of 1540	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	37
PID 1516 wrote to memory of 1540	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	37
PID 1540 wrote to memory of 1908	1540	cmd.exe	39
PID 1540 wrote to memory of 1908	1540	cmd.exe	39
PID 1540 wrote to memory of 1908	1540	cmd.exe	39
PID 1540 wrote to memory of 1908	1540	cmd.exe	39
PID 1908 wrote to memory of 1900	1908	net.exe	40
PID 1908 wrote to memory of 1900	1908	net.exe	40
PID 1908 wrote to memory of 1900	1908	net.exe	40
PID 1908 wrote to memory of 1900	1908	net.exe	40
PID 1516 wrote to memory of 1880	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	41
PID 1516 wrote to memory of 1880	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	41
PID 1516 wrote to memory of 1880	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	41
PID 1516 wrote to memory of 1880	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	41
PID 1880 wrote to memory of 1960	1880	cmd.exe	43
PID 1880 wrote to memory of 1960	1880	cmd.exe	43
PID 1880 wrote to memory of 1960	1880	cmd.exe	43
PID 1880 wrote to memory of 1960	1880	cmd.exe	43
PID 1960 wrote to memory of 1952	1960	net.exe	44
PID 1960 wrote to memory of 1952	1960	net.exe	44
PID 1960 wrote to memory of 1952	1960	net.exe	44
PID 1960 wrote to memory of 1952	1960	net.exe	44
PID 1516 wrote to memory of 1924	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	45
PID 1516 wrote to memory of 1924	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	45
PID 1516 wrote to memory of 1924	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	45
PID 1516 wrote to memory of 1924	1516	._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe	45
PID 1924 wrote to memory of 384	1924	cmd.exe	47
PID 1924 wrote to memory of 384	1924	cmd.exe	47
PID 1924 wrote to memory of 384	1924	cmd.exe	47
PID 1924 wrote to memory of 384	1924	cmd.exe	47

C:\Users\Admin\AppData\Local\Temp\8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
"C:\Users\Admin\AppData\Local\Temp\8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe"
  2⤵
  - Executes dropped EXE
  - Modifies extensions of user files
  - Drops startup file
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop SQLWriter
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Windows\SysWOW64\net.exe
      net stop SQLWriter
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1312
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLWriter
        5⤵
        
        PID:1824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop SQLBrowser
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Windows\SysWOW64\net.exe
      net stop SQLBrowser
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLBrowser
        5⤵
        
        PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Windows\SysWOW64\net.exe
      net stop MSSQLSERVER
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1908
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQLSERVER
        5⤵
        
        PID:1900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\SysWOW64\net.exe
      net stop MSSQL$CONTOSO1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$CONTOSO1
        5⤵
        
        PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop MSDTC
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\SysWOW64\net.exe
      net stop MSDTC
      4⤵
      PID:384
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSDTC
        5⤵
        
        PID:580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
    3⤵
    PID:1504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
    3⤵
    PID:1328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
    3⤵
    PID:560
  - - C:\Windows\SysWOW64\net.exe
      net stop SQLSERVERAGENT
      4⤵
      PID:952
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLSERVERAGENT
        5⤵
        
        PID:828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
    3⤵
    PID:936
  - - C:\Windows\SysWOW64\net.exe
      net stop MSSQLSERVER
      4⤵
      PID:1228
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQLSERVER
        5⤵
        
        PID:2024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop vds
    3⤵
    PID:1460
  - - C:\Windows\SysWOW64\net.exe
      net stop vds
      4⤵
      PID:1064
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop vds
        5⤵
        
        PID:1796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
    3⤵
    PID:1636
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set currentprofile state off
      4⤵
      PID:1848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
    3⤵
    PID:1628
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall set opmode mode=disable
      4⤵
      PID:1872
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  PID:1816

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

MD5
06fdd27742bc4dcb30bc348fa0c24041

SHA1
532db4b18a787d4d6a7e48f0b43c51210312f82b

SHA256
5aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8

SHA512
ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe

MD5
06fdd27742bc4dcb30bc348fa0c24041

SHA1
532db4b18a787d4d6a7e48f0b43c51210312f82b

SHA256
5aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8

SHA512
ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

MD5
934984b11e6690c10e7ad5bf1f0cf274

SHA1
5c826f0bca1460508b0a3db4b0e5f9fbd7c2104f

SHA256
95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e

SHA512
4cc96789b2c6a40b94d7dc5d3ed11876dc643172211114ee588bfc0988f00cc3508d0d1e5d39a08e29b003f12429ba46fa07ac58402d6838b7263a640b20f13e

Download Submit
C:\Users\Admin\AppData\Local\Temp\U9dyD1H2.xlsm

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\Documents\MergeDeny.xlsm

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\Documents\~$cache1

MD5
06fdd27742bc4dcb30bc348fa0c24041

SHA1
532db4b18a787d4d6a7e48f0b43c51210312f82b

SHA256
5aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8

SHA512
ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722

Download Submit
\ProgramData\Synaptics\Synaptics.exe

MD5
06fdd27742bc4dcb30bc348fa0c24041

SHA1
532db4b18a787d4d6a7e48f0b43c51210312f82b

SHA256
5aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8

SHA512
ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722

Download Submit
\ProgramData\Synaptics\Synaptics.exe

MD5
06fdd27742bc4dcb30bc348fa0c24041

SHA1
532db4b18a787d4d6a7e48f0b43c51210312f82b

SHA256
5aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8

SHA512
ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe

MD5
934984b11e6690c10e7ad5bf1f0cf274

SHA1
5c826f0bca1460508b0a3db4b0e5f9fbd7c2104f

SHA256
95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e

SHA512
4cc96789b2c6a40b94d7dc5d3ed11876dc643172211114ee588bfc0988f00cc3508d0d1e5d39a08e29b003f12429ba46fa07ac58402d6838b7263a640b20f13e

Download Submit
memory/384-20-0x0000000000000000-mapping.dmp

Download
memory/560-26-0x0000000000000000-mapping.dmp

Download
memory/580-21-0x0000000000000000-mapping.dmp

Download
memory/688-22-0x0000000000000000-mapping.dmp

Download
memory/828-28-0x0000000000000000-mapping.dmp

Download
memory/936-29-0x0000000000000000-mapping.dmp

Download
memory/952-61-0x000007FEF7D20000-0x000007FEF7F9A000-memory.dmp

Filesize
2.5MB

Download
memory/952-27-0x0000000000000000-mapping.dmp

Download
memory/1064-37-0x0000000000000000-mapping.dmp

Download
memory/1228-31-0x0000000000000000-mapping.dmp

Download
memory/1312-4-0x0000000000000000-mapping.dmp

Download
memory/1328-25-0x0000000000000000-mapping.dmp

Download
memory/1364-3-0x0000000000000000-mapping.dmp

Download
memory/1460-35-0x0000000000000000-mapping.dmp

Download
memory/1504-23-0x0000000000000000-mapping.dmp

Download
memory/1516-1-0x0000000000000000-mapping.dmp

Download
memory/1516-45-0x0000000001250000-0x0000000001261000-memory.dmp

Filesize
68KB

Download
memory/1516-44-0x0000000001660000-0x0000000001671000-memory.dmp

Filesize
68KB

Download
memory/1516-43-0x0000000001250000-0x0000000001261000-memory.dmp

Filesize
68KB

Download
memory/1540-13-0x0000000000000000-mapping.dmp

Download
memory/1584-11-0x0000000000000000-mapping.dmp

Download
memory/1612-30-0x0000000006900000-0x0000000006904000-memory.dmp

Filesize
16KB

Download
memory/1612-34-0x0000000006900000-0x0000000006904000-memory.dmp

Filesize
16KB

Download
memory/1624-12-0x0000000000000000-mapping.dmp

Download
memory/1628-41-0x0000000000000000-mapping.dmp

Download
memory/1636-39-0x0000000000000000-mapping.dmp

Download
memory/1716-10-0x0000000000000000-mapping.dmp

Download
memory/1796-38-0x0000000000000000-mapping.dmp

Download
memory/1816-7-0x0000000000000000-mapping.dmp

Download
memory/1824-8-0x0000000000000000-mapping.dmp

Download
memory/1848-40-0x0000000000000000-mapping.dmp

Download
memory/1872-42-0x0000000000000000-mapping.dmp

Download
memory/1880-16-0x0000000000000000-mapping.dmp

Download
memory/1900-15-0x0000000000000000-mapping.dmp

Download
memory/1908-14-0x0000000000000000-mapping.dmp

Download
memory/1924-19-0x0000000000000000-mapping.dmp

Download
memory/1952-18-0x0000000000000000-mapping.dmp

Download
memory/1960-17-0x0000000000000000-mapping.dmp

Download
memory/2024-33-0x0000000000000000-mapping.dmp

Download