Analysis
-
max time kernel
138s -
max time network
155s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-07-2021 12:39
Static task
static1
Behavioral task
behavioral1
Sample
2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe
-
Size
1.3MB
-
MD5
0e55ead3b8fd305d9a54f78c7b56741a
-
SHA1
f7b084e581a8dcea450c2652f8058d93797413c3
-
SHA256
2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff
-
SHA512
5c3d58d1001dce6f2d23f33861e9c7fef766b7fe0a86972e9f1eeb70bfad970b02561da6b6d193cf24bc3c1aaf2a42a950fa6e5dff36386653b8aa725c9abaaa
Score
10/10
Malware Config
Extracted
Path
C:\PROGRAM FILES\WINDOWS SIDEBAR\GADGETS\SLIDESHOW.GADGET\IMAGES\ON_DESKTOP\readme.txt
Family
dearcry
Ransom Note
Your file has been encrypted!
If you want to decrypt, please contact us.
[email protected] or [email protected]
And please send me the following hash!
638428e5021d4ae247b21acf9c0bf6f6
Signatures
-
DearCry
DearCry is a ransomware first seen after the 2021 Microsoft Exchange hacks.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\ResizeAdd.tiff.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Users\Admin\Pictures\ResolveGroup.tiff.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Users\Admin\Pictures\SuspendUnlock.tif.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Users\Admin\Pictures\SyncDebug.tif.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Users\Admin\Pictures\DebugCompare.tif.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Users\Admin\Pictures\DismountReset.tif.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Pictures\ResizeAdd.tiff 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Pictures\ResolveGroup.tiff 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Users\Admin\Pictures\SkipMount.png.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P8HHGB03\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VNYR844D\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2455352368-1077083310-2879168483-1000\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9RC2MV6\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H18KNA1T\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HNHPAZTY\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X8SF34HL\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VFDYFLB4\desktop.ini 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Common Files\System\DirectDB.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.VN.XML.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Windows Photo Viewer\PhotoViewer.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ContactPicker.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0175428.JPG 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\AddToViewArrowMask.bmp.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcc_plugin.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\xmlrw.dll.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02742U.BMP.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImages.jpg.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\CsiSoap.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENVELOPE.XML 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\libEGL.dll.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382938.JPG.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_rest.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03041I.JPG.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\XLCALL32.DLL.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.jpg.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIconsMask.bmp.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdcp_plugin.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_down_BIDI.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0174952.JPG.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPAPERS.INI.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02470U.BMP.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL026.XML 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_drop_shadow.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\Microsoft.Synchronization.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\9.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7ES.DLL.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\Microsoft.Synchronization.dll.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341551.JPG.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\SUBMIT.JS.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORM.DLL 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_down_BIDI.png 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Teal.css.CRYPT 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck.css 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Messenger.xml 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1004 1208 WerFault.exe 12 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1004 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe"C:\Users\Admin\AppData\Local\Temp\2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1652
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1208 -s 11601⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004