e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f

General

Target

e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Size

7KB
MD5

be6be1c81865e4eb75d01a918812ddea
SHA1

1482d68b097f8ff8c6257a754d7d452b0e34829f
SHA256

e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f
SHA512

ea13391c0fd196486ed40cf359e18995f787a8e46a568f9795ab113757def02ba8f5536a48739c77c9fd2c4eaf763713b31a2e5ebeb0cbab644119d62406ec21

Score

10^/10

persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2513283230-931923277-594887482-1000\HOW TO DECRYPT FILES.txt

Ransom Note

Your files have been encrypted with our software. Photos, documents etc ... WHAT I CAN DO?? You can pay $ 20 in bitcoins to this address: 3QgJDoVEaksAs9kFz1vcueG8DKF4hPrARW As soon as you have made the payment, contact us in this email and we will give you the password bufalo@boximail.com *IMPORTANT* You must have proof of payment

Emails

bufalo@boximail.com

Wallets

3QgJDoVEaksAs9kFz1vcueG8DKF4hPrARW

Signatures

Drops file in Drivers directory 3 IoCs

Processes:

e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe

Drops startup file 1 IoCs

Processes:

e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7c6Wvdoy0nAKv8v.exe"	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe

Drops file in System32 directory 64 IoCs

Processes:

e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\FileRepository\hpoa1nd.inf_amd64_neutral_cf39c48277e038de\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc7.inf_amd64_neutral_348f512722c79525\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sensorsalsdriver.inf_amd64_neutral_1c5bc8e71eb90127\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\IME\imekr8\dicts\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\it-IT\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\ClickDownExpanded.gif	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmolic.inf_amd64_neutral_a53ac1a125d227fc\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx004.inf_amd64_neutral_2cf95f307381e481\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsv003.inf_amd64_neutral_1e0c4fbb9b11b015\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc007.inf_amd64_neutral_2df575afa0f7d35f\Amd64\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnso002.inf_amd64_neutral_c3b7ce4e6f71641f\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnts002.inf_amd64_neutral_ad2aa922aa11af2c\Amd64\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Diagnostics\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lsi_scsi.inf_amd64_neutral_cfbbf0b0b66ba280\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky004.inf_amd64_neutral_5db759db19acd3ae\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\th-TH\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbsb.inf_amd64_neutral_56a9f6bceeec7f72\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\averfx2hbtv_x64.inf_amd64_neutral_7216b6fb23536c40\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmcom.inf_amd64_neutral_716a306ec3899e04\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx003.inf_amd64_neutral_d1510a8315a2ea0d\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnok002.inf_amd64_neutral_616c1e9b7df7d5a9\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdsi.inf_amd64_neutral_e77f438012239042\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00c.inf_amd64_neutral_f0d9ddf52f04765c\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcdp.inf_amd64_neutral_170c11f3a6d3f0a8\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_neutral_7a5f47d3150cc0eb\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\Dism\en-US\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00d.inf_amd64_neutral_ce7a0b4e23e432ad\Amd64\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbvideo.inf_amd64_neutral_836a6716cd56c692\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa3.inf_amd64_neutral_77e515342bd572cc\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmzyxlg.inf_amd64_neutral_14f9249844f1cf17\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnnr002.inf_amd64_neutral_37896c5e81c8d488\Amd64\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremiumN\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-StorageMigration\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\cs-CZ\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr00a.inf_amd64_neutral_e7f3f91e6832ef5c\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnxx002.inf_amd64_neutral_560fdd891b24f384\Amd64\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiaxx002.inf_amd64_neutral_fbe080a7dd77c4a3\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\WindowsPhotoGallery.bmp	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\com\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cdrom.inf_amd64_neutral_0b3d0d1942ab684b\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsv002.inf_amd64_neutral_6ca80563d6148ee5\Amd64\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\000a\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmrock4.inf_amd64_neutral_e45293c539584293\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mcx2.inf_amd64_neutral_8cf9cade8f7bba56\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hpoa1ss.inf_amd64_neutral_8cae09a2238d64e0\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ipmidrv.inf_amd64_neutral_1cb648411f252d13\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc006.inf_amd64_neutral_7e12a60cc98d3f89\Amd64\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IIS-DL\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ISE\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc664.inf_amd64_neutral_673d3dfb961e9b17\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc003.inf_amd64_neutral_47e09b7cc0d9e993\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl002.inf_amd64_neutral_e204d4267d752eb7\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc12.inf_amd64_neutral_ff7295ba5a46d63f\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00e.inf_amd64_neutral_edc631ff41a34218\Amd64\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc00b.inf_amd64_neutral_3338d41663aad5fa\Amd64\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\adp94xx.inf_amd64_neutral_4928c8870f6a1577\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\megasas.inf_amd64_neutral_395276dd9b7a7448\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00a.inf_amd64_neutral_d64d696193e69d7b\Amd64\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\Amd64\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0404\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\SysWOW64\migration\WSMT\rras\dlmanifests\Microsoft-Windows-RasServer-MigPlugin\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe

Drops file in Program Files directory 64 IoCs

Processes:

e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\PREVIEW.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHigh.jpg	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\THMBNAIL.PNG	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03425I.JPG	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Groove.gif	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosecolor.gif	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Program Files\Java\jre7\lib\deploy\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\22.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382961.JPG	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02074U.BMP	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-today.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24Images.jpg	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14656_.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21335_.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR41F.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\BUTTON.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099147.JPG	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099192.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Earthy.gif	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\PREVIEW.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR37F.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\HEADER.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\DRUMROLL.WAV	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Program Files\Windows NT\TableTextService\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143744.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\TAB_ON.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR12F.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid.gif	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_up.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01749_.GIF	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe

Drops file in Windows directory 64 IoCs

Processes:

e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe

description	ioc	process
File created	C:\Windows\winsxs\amd64_cxfalcon_ibv64.inf_31bf3856ad364e35_6.1.7600.16385_none_a242cda757046042\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..rk-msimtf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_40f3084378f264ba\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-kernelbase_31bf3856ad364e35_6.1.7601.17514_none_8f7d2814ff945cd6\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-netwst.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3f0a5d733dbfe1d7\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-shell-comctl32-v5_31bf3856ad364e35_6.1.7601.17514_none_97c2246fee970dbb\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_hidserv.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_822df6c95f3afba7\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-4.htm	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_6.1.7600.16385_none_696bcc240bce3ca9\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-msports_31bf3856ad364e35_6.1.7600.16385_none_e9120c2008f5c03d\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-videosamples_31bf3856ad364e35_6.1.7600.16385_none_51a21f033003affd\Wildlife.wmv	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp3.jpg	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\msil_microsoft.build.tasks.v3.5_b03f5f7f11d50a3a_6.1.7601.17514_none_e8818a0573561a67\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Entity\921c3a0254f77211b4f33a3180a78b0a\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\icon.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..randprintui-prnfldr_31bf3856ad364e35_6.1.7601.17514_none_3a3dfef909e651d8\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_webmintrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_b3ff7f6b81a93d65\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_netfx-cvtresui_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_5e71ce85c0430bf7\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\docked_black_few-showers.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\msil_system.web.entity.design_b77a5c561934e089_6.1.7601.17514_none_9c8e8f9630f084df\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_iscsi.inf_31bf3856ad364e35_6.1.7601.17514_none_9ae9cb230a463c6f\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_eaphost.inf_31bf3856ad364e35_6.1.7600.16385_none_8a6d7605895cd38e\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_mdmirmdm.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_996308fc0ff8b91f\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ipnat.resources_31bf3856ad364e35_6.1.7600.16385_en-us_403d5e98a5c3edc2\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mssign32-dll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_19ec38460d920c99\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_de-de_5912a2afaa3db0fd\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Core\83e2f6909980da7347e7806d8c26670e\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..ediadisc-style-full_31bf3856ad364e35_6.1.7600.16385_none_ce3a164d3f0fa152\NavigationUp_SelectionSubpicture.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..tyle-resizingpanels_31bf3856ad364e35_6.1.7600.16385_none_bc51073aee3391ed\NavigationLeft_SelectionSubpicture.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_wpdmtphw.inf_31bf3856ad364e35_6.1.7600.16385_none_54337c1f491bfb7d\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-babygirl_31bf3856ad364e35_6.1.7600.16385_none_b2bd01695c9021fd\button-highlight.png	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be\Desert.jpg	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-rasapi_31bf3856ad364e35_6.1.7601.17514_none_cb5d84d96624bcbd\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wmi-provider-common_31bf3856ad364e35_6.1.7600.16385_none_0434b662f2d183a0\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-lpksetup.resources_31bf3856ad364e35_6.1.7600.16385_en-us_31e8e2f9095192cc\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_6.1.7600.16385_none_ed38f66d69c578dc\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-uianimation.resources_31bf3856ad364e35_7.1.7601.16492_de-de_7dd5704a8e1cca76\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_3eceef6140ec9728\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-powershell_31bf3856ad364e35_6.1.7601.17514_none_65ab62a5f1bba14b\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-processmodel_31bf3856ad364e35_6.1.7601.17514_none_1f3c3defefc3a10e\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_1bac0b4d803e969e\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d10.1_31bf3856ad364e35_7.1.7601.16492_none_4348f88492fd6ee6\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..-wow64-setupdll001b_31bf3856ad364e35_6.1.7600.16385_none_488d8dfccb279605\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_ehstorcertdrv.inf_31bf3856ad364e35_6.1.7600.16385_none_36454688d51936c3\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\msil_microsoft.powershel..gnostics.activities_31bf3856ad364e35_7.2.7601.16406_none_c2cafdbb981bdf22\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_6.1.7601.17514_none_d0fbe940e38daf1f\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\inf\.NET CLR Networking 4.0.0.0\001D\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Annotations\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_While.help.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-themeui_31bf3856ad364e35_6.1.7601.17514_none_8706005e79c34246\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V4381984f#\318ed224be5957e6c33cc57fd6796dc0\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_be8acdd10de3b1a6\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_7.2.7601.16406_none_e237a9baed4f587b\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-font-fms.resources_31bf3856ad364e35_6.1.7600.16385_hr-hr_90a99e0858767c9e\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Garden.jpg	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\6.1.0.0__31bf3856ad364e35\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\amd64_prnca00x.inf_31bf3856ad364e35_6.1.7600.16385_none_e90677c70609283c\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlediting_31bf3856ad364e35_11.2.9600.16428_none_34d4a6c78cd3b895\HOW TO DECRYPT FILES.txt	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe

Modifies registry class 10 IoCs

Processes:

e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU\ = "CRYPTED!"	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU\shell\open	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7c6Wvdoy0nAKv8v.exe"	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.emilisub	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.emilisub\ = "DSQXJGUFDMNBJFU"	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU\DefaultIcon	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7c6Wvdoy0nAKv8v.exe,0"	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU\shell\open\command	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU\shell	e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe

C:\Users\Admin\AppData\Local\Temp\e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
"C:\Users\Admin\AppData\Local\Temp\e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2040

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\HOW TO DECRYPT FILES.txt
1⤵
PID:1708

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Desktop\HOW TO DECRYPT FILES.txt
MD5
8dcd6ea3b6f1b784daafdb93a8e3b997

SHA1
2a54aa2116f6bd50acaf8e3d019a8b7f7390bf63

SHA256
ae962c8d9e65bc1a3002ed16ccf1e6019d6412ba7c71ad40c54584750e5dfc57

SHA512
7c705205112c719eceaa02c22d823e20442479091bcef8698d9847eff51780e1bd7fc0464e6341de2e78d8156fd479332da983fa86b0ee7607fc19c8c691a1eb

Download Submit
memory/1708-61-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download
memory/2040-60-0x0000000076281000-0x0000000076283000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads