16a58ca32a6575dfe91423f6844b1183ba35b8be1cf211773f09b230f1bd5102

General

Target

45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
Size

149KB
MD5

fdbd0ccb8d0bea52f95cedb51c3de9e9
SHA1

d6fa30eeb170c70fc3892429df2872372b3cef48
SHA256

45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e
SHA512

3457221f4ef4e0e79f694f89b30c36fe731037f1565aae49d9b0bb151c6e50fb0523c0f7a82ba333726bd2f9822561e3ee794bacc1e8f052ea9a3a7d5bcbe3d0

Score

8^/10

ransomware spyware upx

Malware Config

Signatures

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\SelectUse.crw => C:\Users\Admin\Pictures\SelectUse.crw.cnh	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\Pictures\TestWrite.tiff	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File renamed	C:\Users\Admin\Pictures\UnpublishUnregister.tif => C:\Users\Admin\Pictures\UnpublishUnregister.tif.cnh	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File renamed	C:\Users\Admin\Pictures\TestWrite.tiff => C:\Users\Admin\Pictures\TestWrite.tiff.cnh	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File renamed	C:\Users\Admin\Pictures\LockWatch.tif => C:\Users\Admin\Pictures\LockWatch.tif.cnh	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1732-2-0x000000013F9C0000-0x000000013FA2D000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README.txt	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 77 IoCs

Processes:

45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\F6O5NPVK\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Public\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\8DDKLDOL\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M1AZJ0WQ\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AT22T7OH\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F6QQJELO\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3825035466-2522850611-591511364-1000\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXBH52U7\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe

Drops file in Program Files directory 12054 IoCs

Processes:

45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre7\bin\jfr.dll	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\README.txt	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\VSTAClientPkg.dll	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107146.WMF	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0294991.WMF	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CHECKBOX.JPG	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\glass_lrg.png	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\README.txt	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Flow.eftx	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGREPFRM.XML	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\flower.png	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\METCONV.DLL	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0240175.WMF	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0251007.WMF	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.SqlServerCe.dll	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.FNT	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01747_.GIF	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Median.xml	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg.png	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195248.WMF	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00640_.WMF	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR26F.GIF	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASK.CFG	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\README.txt	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.JS	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OFFRHD.DLL	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN054.XML	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BORDERBB.DPV	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\icon.png	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21295_.GIF	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00361_.WMF	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00005_.WMF	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR33B.GIF	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN111.XML	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\86.0.4240.111\86.0.4240.111.manifest	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Makassar	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149018.JPG	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\Management.cer	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBrowserUpgrade.html	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe

Drops file in Windows directory 1 IoCs

Processes:

45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe

description ioc process

File created C:\Windows\README.txt 45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1816 1276 WerFault.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1816 WerFault.exe
1816 WerFault.exe
1816 WerFault.exe
1816 WerFault.exe
1816 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1816 WerFault.exe

description	ioc	process
File created	C:\Windows\README.txt	45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe

pid	pid_target	process	target process
1816	1276	WerFault.exe

pid	process
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1816	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
"C:\Users\Admin\AppData\Local\Temp\45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1732

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1276 -s 2896
1⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1816

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3825035466-2522850611-591511364-1000\desktop.ini
MD5
d749a57e053bd9818df4d42565eef487

SHA1
91b81b36dc92ca32e36a91045ebd22bd497679b7

SHA256
58b5f861c25086e200a2e049184946b0ddbc94e5467686b35be33b56067bbf8d

SHA512
c11173742ba568d3b0297f16d7a6574822413aea3aa82c6ac3eabdfdf3d14b5669c6e1aad43c86314b8fe319571e5e612c77d59e97405c1cec3e064bdceafd4e

Download Submit
memory/1732-2-0x000000013F9C0000-0x000000013FA2D000-memory.dmp

Filesize
436KB

Download
memory/1816-4-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmp

Filesize
8KB

Download
memory/1816-6-0x0000000001D70000-0x0000000001D81000-memory.dmp

Filesize
68KB

Download
memory/1816-5-0x0000000001D70000-0x0000000001D81000-memory.dmp

Filesize
68KB

Download
memory/1816-8-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads