Analysis
-
max time kernel
53s -
max time network
168s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-07-2021 14:49
Static task
static1
Behavioral task
behavioral1
Sample
2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe
-
Size
1.3MB
-
MD5
0e55ead3b8fd305d9a54f78c7b56741a
-
SHA1
f7b084e581a8dcea450c2652f8058d93797413c3
-
SHA256
2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff
-
SHA512
5c3d58d1001dce6f2d23f33861e9c7fef766b7fe0a86972e9f1eeb70bfad970b02561da6b6d193cf24bc3c1aaf2a42a950fa6e5dff36386653b8aa725c9abaaa
Score
10/10
Malware Config
Extracted
Path
C:\PROGRAM FILES\WINDOWS SIDEBAR\GADGETS\SLIDESHOW.GADGET\IMAGES\ON_DESKTOP\readme.txt
Family
dearcry
Ransom Note
Your file has been encrypted!
If you want to decrypt, please contact us.
[email protected] or [email protected]
And please send me the following hash!
638428e5021d4ae247b21acf9c0bf6f6
Signatures
-
DearCry
DearCry is a ransomware first seen after the 2021 Microsoft Exchange hacks.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\ConvertFromBackup.png.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Users\Admin\Pictures\CopyInvoke.png.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Users\Admin\Pictures\DebugExport.tif.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2455352368-1077083310-2879168483-1000\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9RC2MV6\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X8SF34HL\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H18KNA1T\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P8HHGB03\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VFDYFLB4\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VNYR844D\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HNHPAZTY\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01265U.BMP.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLFLTR.DLL 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341448.JPG 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02567J.JPG.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL026.XML 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_autodel_plugin.dll.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceAmharic.txt 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)alertIcon.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEERR.DLL 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\SOLVSAMP.XLS 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Casual.css 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\34.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\drag.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Concourse.xml 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\THMBNAIL.PNG.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ur.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Form.zip 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OLMAPI32.DLL 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7ES.DLL.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEIRM.XML 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\7-Zip\Lang\ms.txt.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libgme_plugin.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\setup.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\MSOSVINT.DLL 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BULLETS.DLL.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME25.CSS.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Premium.css 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPSLAX.DLL 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCARD.XML.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\VideoLAN\VLC\plugins\gui\libqt_plugin.dll.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libgnutls_plugin.dll.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.jpg.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\4.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\WTSP61MS.DLL 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libball_plugin.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Apothecary.xml.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ur.dll.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPOLK.DLL 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1792 1200 WerFault.exe 17 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1792 WerFault.exe 1792 WerFault.exe 1792 WerFault.exe 1792 WerFault.exe 1792 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1792 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe"C:\Users\Admin\AppData\Local\Temp\2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1508
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1200 -s 19561⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1792