dearcry | fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65

General

Target

fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
Size

1.3MB
MD5

6be28a4523984698e7154671f73361bf
SHA1

b974375ef0f6dcb6ce30558df2ed8570bf1ad642
SHA256

fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65
SHA512

c3a44431e8cbb76d75ea2a1caca6fe77dfbd2a9565da918620433d415d396c08394ecb1c6454fc69661d61683711e53b60a69435e25518a04e81c20136f62f20

Score

10^/10

dearcry ransomware spyware stealer

Malware Config

Extracted

Path

C:\PROGRAM FILES\WINDOWS SIDEBAR\GADGETS\SLIDESHOW.GADGET\IMAGES\ON_DESKTOP\readme.txt

Family

dearcry

Ransom Note

Your file has been encrypted! If you want to decrypt, please contact us. [email protected] or [email protected] And please send me the following hash! d37fc1eabc6783a418d23a8d2ba5db5a

Emails

[email protected]

Signatures

DearCry
DearCry is a ransomware first seen after the 2021 Microsoft Exchange hacks.
ransomware dearcry
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 62 IoCs

Processes:

fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe

description	ioc	process
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\8DDKLDOL\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\F6O5NPVK\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXBH52U7\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3825035466-2522850611-591511364-1000\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F6QQJELO\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Public\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M1AZJ0WQ\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D08RECS3\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AT22T7OH\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RKGIF8TT\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe

Drops file in Program Files directory 64 IoCs

Processes:

fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\id.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\slideShow.js	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Mozilla Firefox\platform.ini	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\index.html.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\currency.css	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\cpu.js	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\BackupUnlock.iso.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\Mozilla Firefox\install.log.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\7-Zip\License.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\uninstall.log.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\cpu.css	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\7-Zip\History.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\VideoLAN\VLC\THANKS.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.CRYPT	fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2040 1268 WerFault.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2040 WerFault.exe

pid	pid_target	process	target process
2040	1268	WerFault.exe

pid	process
2040	WerFault.exe
2040	WerFault.exe
2040	WerFault.exe
2040	WerFault.exe
2040	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	2040	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe
"C:\Users\Admin\AppData\Local\Temp\fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:292

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1268 -s 2940
1⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-2-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Filesize
8KB

Download
memory/2040-3-0x0000000002050000-0x0000000002061000-memory.dmp

Filesize
68KB

Download
memory/2040-4-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing