General
Target

8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe

Filesize

208KB

Completed

01-07-2021 04:41

Task

behavioral3

Score
10/10
MD5

7ee92bcaa1305c7964a993e7f1c3761c

SHA1

6351e156b5fe1d3ae91fec6eb367782b1373111c

SHA256

8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97

SHA256

3b5114e9b3e53ac7711df9fa5ad3dc66ce309ade04768cd334f1e1f1b311a9c36f43e6cf167d338e94116ee08dc686c0a000064a40bb2913e1e8b6b8b143c387

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2513283230-931923277-594887482-1000\HOW TO DECRYPT FILES.txt

Ransom Note
Hi, as you can see, all your files are encrypted. Don't panic, you can decrypt them, you just have to pay me for the ransom. Payment is made only by bitcoin, and the amount you have to pay is 0.03 BITCOIN You can buy very easily from these sites: www.localbitcoins.com www.paxful.com A list of several sites where you can buy bitcoin can be found here: https://bitcoin.org/en/exchanges Make sure the address where you will send the bitcoin is: 1DENGvxJZofU9BVfiScrgZHhhntJ3sAPSd After sending, contact us at this email address: zucano@tuta.io With this subject: ZUCANO03TUTA394821 After confirming the payment, you will receive a tutorial and the keys for decrypting the files.
Emails

zucano@tuta.io

Wallets

1DENGvxJZofU9BVfiScrgZHhhntJ3sAPSd

Signatures 9

Filter: none

Collection
Credential Access
Defense Evasion
Persistence
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Adds Run key to start application
    8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yd0N5k3r1TF75n3.exe"8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
  • Drops desktop.ini file(s)
    8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQE06QBJ\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AJ1NIV9I\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2MTLR0RV\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\$Recycle.Bin\S-1-5-21-2513283230-931923277-594887482-1000\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\93PHUZFG\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\XVLP3GFJ\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SLC8MVWU\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VLFEZDK1\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MLS6OOW4\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
  • Drops file in Program Files directory
    8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15058_.GIF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR4B.GIF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_TexturedBlue.gif8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107528.WMF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Document Themes 14\Trek.thmx8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfig.zip8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-disable.png8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\alertIcon.png8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\Java\jre7\README.txt8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\CAN.WAV8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151047.WMF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\THMBNAIL.PNG8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR10F.GIF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\StarterNotificationDescriptors.xml8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid.gif8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent.png8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02269_.WMF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\settings.js8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\GostTitle.XSL8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\LISTBOX.JPG8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File createdC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\HOW TO DECRYPT FILES.txt8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\33.png8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18226_.WMF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Earthy.gif8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow.css8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\LightSpirit.css8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\7-Zip\Lang\lv.txt8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187819.WMF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0240719.WMF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\SPACER.GIF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBrowserUpgrade.html8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File createdC:\Program Files (x86)\Microsoft.NET\RedistList\HOW TO DECRYPT FILES.txt8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Main.gif8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePageStyle.css8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Templates\1033\OriginReport.Dotx8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03143I.JPG8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115868.GIF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\HOW TO DECRYPT FILES.txt8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\HOW TO DECRYPT FILES.txt8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File createdC:\Program Files\VideoLAN\VLC\plugins\mux\HOW TO DECRYPT FILES.txt8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File createdC:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\HOW TO DECRYPT FILES.txt8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02041_.WMF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\background.png8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_right.png8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01297_.GIF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18242_.WMF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Windows Defender\en-US\MpAsDesc.dll.mui8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\de.pak8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    File opened for modificationC:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\18.png8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    11721220WerFault.exe
  • Modifies registry class
    8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\ESDKZKDTQDWHAGF\DefaultIcon8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\ESDKZKDTQDWHAGF\shell\open8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\ESDKZKDTQDWHAGF8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\ESDKZKDTQDWHAGF\ = "CRYPTED!"8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\ESDKZKDTQDWHAGF\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yd0N5k3r1TF75n3.exe,0"8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\ESDKZKDTQDWHAGF\shell\open\command8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\ESDKZKDTQDWHAGF\shell8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\ESDKZKDTQDWHAGF\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yd0N5k3r1TF75n3.exe"8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.ZuCaNo8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.ZuCaNo\ = "ESDKZKDTQDWHAGF"8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
  • Suspicious behavior: EnumeratesProcesses
    WerFault.exe

    Reported IOCs

    pidprocess
    1172WerFault.exe
    1172WerFault.exe
    1172WerFault.exe
    1172WerFault.exe
    1172WerFault.exe
  • Suspicious behavior: GetForegroundWindowSpam
    WerFault.exe

    Reported IOCs

    pidprocess
    1172WerFault.exe
  • Suspicious use of AdjustPrivilegeToken
    WerFault.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1172WerFault.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    "C:\Users\Admin\AppData\Local\Temp\8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe"
    Adds Run key to start application
    Drops desktop.ini file(s)
    Drops file in Program Files directory
    Modifies registry class
    PID:1996
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1220 -s 2828
    Program crash
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of AdjustPrivilegeToken
    PID:1172
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
    Discovery
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Privilege Escalation
                  Replay Monitor
                  00:00 00:00
                  Downloads
                  • C:\$Recycle.Bin\S-1-5-21-2513283230-931923277-594887482-1000\desktop.ini

                    MD5

                    ae826693a0ca88e37b7052d458249fe1

                    SHA1

                    7929f30c5e5dd96292be1c13e93cf838f47e4dcc

                    SHA256

                    e20d5d5e3c94e52b29d16162c0c7f96f3bebe443ed88e4f35159ae7055017661

                    SHA512

                    7133d36f2dbd2cfb1c74f09a86033ae91d9d8a52dc4535c78953ab128973332a2ecb3a69446dee8dff8bbcb80985236050520580799fe2106a4fa6318a4665df

                  • memory/1172-61-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

                  • memory/1172-62-0x0000000000330000-0x0000000000331000-memory.dmp

                  • memory/1996-59-0x0000000075D41000-0x0000000075D43000-memory.dmp