Analysis
-
max time kernel
139s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
19-04-2021 11:53
Static task
static1
Behavioral task
behavioral1
Sample
e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
-
Size
7KB
-
MD5
be6be1c81865e4eb75d01a918812ddea
-
SHA1
1482d68b097f8ff8c6257a754d7d452b0e34829f
-
SHA256
e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f
-
SHA512
ea13391c0fd196486ed40cf359e18995f787a8e46a568f9795ab113757def02ba8f5536a48739c77c9fd2c4eaf763713b31a2e5ebeb0cbab644119d62406ec21
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\HOW TO DECRYPT FILES.txt
Ransom Note
Your files have been encrypted with our software.
Photos, documents etc ...
WHAT I CAN DO??
You can pay $ 20 in bitcoins to this address:
3QgJDoVEaksAs9kFz1vcueG8DKF4hPrARW
As soon as you have made the payment, contact us in this email and we will give you the password
bufalo@boximail.com
*IMPORTANT*
You must have proof of payment
Emails
bufalo@boximail.com
Wallets
3QgJDoVEaksAs9kFz1vcueG8DKF4hPrARW
Signatures
-
Drops file in Drivers directory 3 IoCs
Processes:
e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exedescription ioc process File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exedescription ioc process File renamed C:\Users\Admin\Pictures\ReceiveCompress.png => C:\Users\Admin\Pictures\ReceiveCompress.png.emilisub e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File renamed C:\Users\Admin\Pictures\WatchMeasure.png => C:\Users\Admin\Pictures\WatchMeasure.png.emilisub e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe -
Drops startup file 1 IoCs
Processes:
e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7c6Wvdoy0nAKv8v.exe" e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe -
Drops file in System32 directory 64 IoCs
Processes:
e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exedescription ioc process File created C:\Windows\SysWOW64\sppui\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\SysWOW64\uk-UA\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnttme.inf_amd64_a6f2aff0a7904a2a\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj4.inf_amd64_54ee1608ff824595\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_932e3738220f305c\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\c_usbdevice.inf_amd64_4a01b3bc76446d76\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaky002.inf_amd64_8bc636137e0a7c8d\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\msclmd.inf_amd64_3f8c874cf5412db3\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaca00j.inf_amd64_2b730d5c3b5d1ba1\amd64\MP280\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\prnkycl1.inf_amd64_d830c6577c8a2c44\amd64\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\prnnecl2.inf_amd64_fdd93c90b4633940\amd64\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\rdvgwddmdx11.inf_amd64_b3ecd559f2f47852\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\wpdmtphw.inf_amd64_93847c0f3602751f\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_e22da3cb2d7a1ed6\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\ipmidrv.inf_amd64_85ba0a537ee1bb61\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsupra.inf_amd64_d67b9818b55c328f\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmti.inf_amd64_55df47a6979d0984\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmetri.inf_amd64_998d032450dfea33\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrk1.inf_amd64_ae5b829575ed1ac2\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\en-GB\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\wiabr00b.inf_amd64_a805479ed1ae0d51\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaca00j.inf_amd64_2b730d5c3b5d1ba1\amd64\MX860\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\en-US\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\sdfrd.inf_amd64_eec092acf44d0f6e\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_08f6d3fc478987f0\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\en\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdcm6.inf_amd64_94e8046a28a1d7ea\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnova.inf_amd64_9696f6f35d789e27\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnttp.inf_amd64_cb7c8349fd73523e\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\prnge001.inf_amd64_e697c1d4e9d89b07\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Kds\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\mbtr8897w81x64.inf_amd64_fd074d03451ecbb5\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifibus.inf_amd64_cef6f6f07739990c\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\prngeclv.inf_amd64_5626f47f96e3c55b\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\prnnecl2.inf_amd64_fdd93c90b4633940\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\ucmucsi.inf_amd64_a1c07c035c931b38\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\usbhub3.inf_amd64_6ea6830940f8f4e2\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\c_modem.inf_amd64_e5be8b0fe43798ef\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\hdaudss.inf_amd64_9fdb305a750a8f78\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\scmbus.inf_amd64_7fb5f9272f2cba00\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\stexstor.inf_amd64_fefc1160d15aa667\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcdp.inf_amd64_2a65d22cd1112b4f\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdp2.inf_amd64_1ebd1ef87e1ad917\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\SysWOW64\setup\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_ded82fc1c2b41e6b\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpbus.inf_amd64_9e4fd69bbfb40126\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\en-US\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\c_image.inf_amd64_1beca3b08880bfc8\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\wgencounter.inf_amd64_bdd64cbba1f77e90\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fsencryption.inf_amd64_a35fdec8f5f7482c\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcm28.inf_amd64_04957cd63cfa547e\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_960a76222168b3fa\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\wvpci.inf_amd64_d7dfaeafc5f693d0\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fscfsmetadataserver.inf_amd64_8e6c82a73ba430a5\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhpcl5.inf_amd64_d79d88c2b839182e\amd64\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\SysWOW64\InputMethod\CHS\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\amdsata.inf_amd64_ea60132f1a9a7a62\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\c_hdc.inf_amd64_c7e22b16326b9e43\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_84bf249d7c59a58c\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\System32\DriverStore\FileRepository\netwlan92de.inf_amd64_e48f9eb16b3dd4ad\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe -
Drops file in Program Files directory 64 IoCs
Processes:
e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exedescription ioc process File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\clone.scale-140.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\starttile.dualsim2.sad.small.scale-150.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Buttons\Solve\autosolve_button_over.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress-indeterminate.gif e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreBadgeLogo.scale-100.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-48.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-36_altform-unplated.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreMedTile.scale-100.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\DailyChallenges\LargeTriPeaksTile.jpg e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\punch.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\cc_16x11.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\SmallTile.scale-200.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp_2x.gif e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\angry.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6416_32x32x32.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupLargeTile.scale-100.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\tumbleweed.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\gf_60x42.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80_altform-unplated_contrast-black.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.Xaml.Toolkit\Assets\Arkadium-logo-credit.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookSmallTile.scale-400.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\lipssealed.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\tk_60x42.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2494_40x40x32.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\SmallTile.scale-100.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-16_altform-unplated_contrast-white.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-ae\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\SplashScreen\SolitaireUpperLeftImage_Large.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-30.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_ok.gif e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view-2x.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Workflow\NavColumn_Black\Icon_Advanced Layout.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\Glyphs\Font\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36_altform-unplated.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviewers.gif e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\thinking.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\js\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-100.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line_2x.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-256.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2_48x48x32.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\hug.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\THMBNAIL.PNG e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\THMBNAIL.PNG e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\130\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Program Files\Windows NT\TableTextService\en-US\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\contrast-black\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-36_altform-unplated_contrast-white.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\OneConnectMedTile.scale-100.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\tf_60x42.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxAccountsLargeTile.scale-100.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe -
Drops file in Windows directory 64 IoCs
Processes:
e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exedescription ioc process File opened for modification C:\Windows\Media\Ring03.wav e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_hidbth.inf.resources_31bf3856ad364e35_10.0.15063.0_en-us_ddcfefd2ac0c5e8c\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-64_altform-unplated.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCache-Light.scale-100.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Toolkit\Images\DfaultProfileImage.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_dual_c_smartcard.inf_31bf3856ad364e35_10.0.15063.0_none_4313e4287b1ca5e1\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ybinaries.resources_31bf3856ad364e35_10.0.15063.0_en-us_1e04b912f5fe7d41\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_wiaca00j.inf_31bf3856ad364e35_10.0.15063.0_none_53a73a8467cc268a\amd64\MX870\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..al-backcompat-tlb28_31bf3856ad364e35_10.0.15063.0_none_baf3b53f8978ab2c\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performance.resources_31bf3856ad364e35_10.0.15063.0_en-us_57c7495250910b4d\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-qwave.resources_31bf3856ad364e35_10.0.15063.0_en-us_87ca0e423a05b4db\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_netfx4-alink_dll_b03f5f7f11d50a3a_4.0.15552.17062_none_c470ccf6d7f2d864\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\5601_40x40x32.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\SystemApps\ContactSupport_cw5n1h2txyewy\Assets\MediumTile.scale-100_contrast-white.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechrecognizer-en-us_31bf3856ad364e35_10.0.15063.0_none_c822a30e253b6625\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\happy.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..lays-classextension_31bf3856ad364e35_10.0.15063.0_none_86242730a9c612b3\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oyment-zipcontainer_31bf3856ad364e35_10.0.15063.0_none_3e7b30cd0f8ecf5d\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_4.0.14917.0_none_f3c1338b927d5aee\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\x86_microsoft-windows-errorreportingui_31bf3856ad364e35_10.0.15063.0_none_835a6852828895fe\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\MapsSplashScreen.scale-125.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hydrogenshell-physics_31bf3856ad364e35_10.0.15063.0_none_075a24f1e2575e0c\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_ntprint4.inf_31bf3856ad364e35_10.0.15063.0_none_5733fcd7dd4d7ae2\Amd64\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\msil_system.io.compression_b77a5c561934e089_4.0.14917.0_none_425edb9ca92c5caa\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\msil_system.servicemodel.ref_b77a5c561934e089_10.0.15063.0_none_25b6645faf193713\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..rammar.0804.cortana_31bf3856ad364e35_10.0.15063.0_none_ea1a387e477ce931\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-credprovhost-library_31bf3856ad364e35_10.0.15063.0_none_cee620359b50879e\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\x86_microsoft-windows-mssip32-dll_31bf3856ad364e35_10.0.15063.0_none_2b56745619efd89c\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-72.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-management-clients_31bf3856ad364e35_10.0.15063.0_none_039f99c6b89e54c2\Hyper-V Manager.lnk e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.15063.0_none_36da1a52f2dcda9b\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\msil_microsoft.powershell.security_31bf3856ad364e35_1.0.0.0_none_42db5b8a5d017d99\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailSmallTile.scale-100.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorWideTile.contrast-black_scale-200.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..trast-white.cortana_31bf3856ad364e35_10.0.15063.0_none_c7203a9c4dfdf241\AppListIcon.targetsize-24.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_netfx4-workflowserv..ormancecounters_man_b03f5f7f11d50a3a_4.0.14917.0_none_d08b5f7127ad68ce\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\x86_netfx4-webengine4_dll_b03f5f7f11d50a3a_4.0.14917.0_none_3a5c1ae9c336a0b9\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\MMCFxCommon\3d9f990f784ba969dae920d959d40963\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.15063.0_none_5a69877f495f87b2\RatingStars34.contrast-white_scale-200.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-programs-adm.resources_31bf3856ad364e35_10.0.15063.0_en-us_447968bee05e5ebf\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tetheringmgr.resources_31bf3856ad364e35_10.0.15063.0_en-us_4b7e28852c571b9b\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..hellapi-holographic_31bf3856ad364e35_10.0.15063.0_none_c0df00dc19b51a13\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxLargeTile.scale-125.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\MiracastView\Assets\TinyTile.contrast-black_scale-100.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nifests-onecorebase_31bf3856ad364e35_10.0.15063.0_none_366e21037cc214d6\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\x86_microsoft-windows-netshell_31bf3856ad364e35_10.0.15063.0_none_8a78a8888e7c115f\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\x86_microsoft-windows-rpc-ns_31bf3856ad364e35_10.0.15063.0_none_c737898553b0ee37\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\x86_netfx4-mscoree_tlb_b03f5f7f11d50a3a_4.0.14917.0_none_f720beae7c85e167\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\InfusedApps\Packages\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\AppxMetadata\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_c_wceusbs.inf.resources_31bf3856ad364e35_10.0.15063.0_en-us_16e82e06b9b37d83\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.15063.0_none_7f41b0a5d17e992b\Magnify.lnk e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\msil_system.web.mobile_b03f5f7f11d50a3a_4.0.14917.0_none_935923feb33bf8f0\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\SystemResources\Windows.UI.MiracastView\pris\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\SkypeApp\Assets\LockScreenBadgeLogo.scale-100.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anese-softkeyapplet_31bf3856ad364e35_10.0.15063.0_none_828050b1fafef6e9\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..baaupdate.resources_31bf3856ad364e35_10.0.15063.0_en-us_b37f3dfb15ffc1db\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\x86_netfx4-sys_windows_forms_tlb_b03f5f7f11d50a3a_4.0.14917.0_none_ba0bae33ff368912\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-150.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\WinSxS\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.15063.0_es-mx_a1edb67aef1a065e\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ExchangeMediumTile.scale-400.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe File opened for modification C:\Windows\SystemApps\Microsoft.PPIProjection_cw5n1h2txyewy\Assets\Square310x310.contrast-black_Scale-180.png e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe -
Modifies registry class 10 IoCs
Processes:
e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.emilisub\ = "DSQXJGUFDMNBJFU" e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU\ = "CRYPTED!" e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7c6Wvdoy0nAKv8v.exe,0" e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7c6Wvdoy0nAKv8v.exe" e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.emilisub e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU\DefaultIcon e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU\shell\open\command e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU\shell e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU\shell\open e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DSQXJGUFDMNBJFU e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe"C:\Users\Admin\AppData\Local\Temp\e3518a8b3fd422f192fd90049186ea01ff120bdb72d3652c0933b31399b9b90f.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class