Analysis
-
max time kernel
136s -
max time network
135s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
09/11/2021, 17:36
Static task
static1
Behavioral task
behavioral1
Sample
88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe
-
Size
764KB
-
MD5
2f9fc82898d718f2abe99c4a6fa79e69
-
SHA1
9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb
-
SHA256
88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
-
SHA512
19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b
Score
10/10
Malware Config
Signatures
-
Hive
A ransomware written in Golang first seen in June 2021.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops file in Drivers directory 20 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ResumeUnregister.tiff 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\Links\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NSRO2PSX\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\Music\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ORVXVB76\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8O10X0LQ\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Public\Music\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Public\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-103686315-404690609-2047157615-1000\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\0WAF332L\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZTH0NOOE\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Public\Videos\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_neutral_86bb50f34c49ae71\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\ql2300.inf_amd64_neutral_ca8487daf77ff7cb\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\Tasks\Microsoft\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\HomePremiumE\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\000e\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\Tasks\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\config\systemprofile\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcpv.inf_amd64_neutral_5667cca434e3a6b7\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_neutral_f77725472d91b1d1\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca003.inf_amd64_neutral_8e91d4aa9330d2f8\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\002d\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\ja-JP\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\wbem\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0024\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremium\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\migration\WSMT\rras\replacementmanifests\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\migwiz\PostMigRes\Web\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpin.inf_amd64_neutral_2415474b9db0a888\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_neutral_4616c3de1949be6d\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr004.inf_amd64_neutral_a78e168d6944619a\Amd64\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\config\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\Enterprise\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\hu-HU\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx003.inf_amd64_neutral_d1510a8315a2ea0d\Amd64\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\UltimateN\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\elxstor.inf_amd64_neutral_4263942b9dfe9077\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmolic.inf_amd64_neutral_a53ac1a125d227fc\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc00c.inf_amd64_neutral_53a58f4fd7d88575\Amd64\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\es-ES\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\spp\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\com\en-US\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomePremium\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa3.inf_amd64_neutral_77e515342bd572cc\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmags64.inf_amd64_neutral_e68956e24e287714\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_neutral_5eb6ac70dd1a3ad0\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\XPSViewer\de-DE\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\LogFiles\Windows Portable Devices\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_neutral_0684fdc43059f486\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\0024\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDiagnostics\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\ja-JP\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc002.inf_amd64_neutral_fdb6f2e252435905\Amd64\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\avmx64c.inf_amd64_neutral_8ebb15bf548db022\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky003.inf_amd64_neutral_fe7ea176f20ab839\Amd64\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_neutral_f935002f367d5bb0\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\wstorvsc.inf_amd64_neutral_d7bf942e99bb1d41\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\0005\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\DriverStore\fr-FR\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\ProfessionalE\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\winrm\0407\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\IME\IMEJP10\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmoto1.inf_amd64_neutral_bf4b404852955eb4\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky305.inf_amd64_ja-jp_4d77cc4802b17ec3\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky007.inf_amd64_neutral_e637699044f367f3\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00z.inf_amd64_neutral_aea50acf04a2db1d\Amd64\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Professional\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\avc.inf_amd64_neutral_3ef33c750e6308ce\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00d.inf_amd64_neutral_dd61103f3a2743d4\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.1JTVwRBQdy3fOYnMUyubw8nvSX3Ls0NhN0izzyrpDXw.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLTASK.FAE 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\te.pak.1JTVwRBQdy3fOYnMUyubw8na7XJecmk3aIUfaoHcHxI.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01252_.WMF.1JTVwRBQdy3fOYnMUyubw_tdASpHgeFgMWR92ydngXY.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar.1JTVwRBQdy3fOYnMUyubwyl6sCGYdYk3SmmlxWZr808.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02431_.WMF.1JTVwRBQdy3fOYnMUyubw289PIJhKPUadkNzlyRgLAo.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2B.GIF.1JTVwRBQdy3fOYnMUyubw6wWsLBjBJB_Cb3Ib3oJYCY.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\settings.js 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187847.WMF.1JTVwRBQdy3fOYnMUyubw7c8te-DRlJcH2j0qVplBwM.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02262_.WMF.1JTVwRBQdy3fOYnMUyubw9PTZBWf2fRJe4s7pr5kL3k.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR31F.GIF.1JTVwRBQdy3fOYnMUyubw-nTqOKK2cxGTWs8IvwUvAk.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar.1JTVwRBQdy3fOYnMUyubw4eG4_ZdbRlUNO6Gr_aaExA.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293570.WMF 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\MSN MoneyCentral Investor Currency Rates.iqy 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Flow.xml.1JTVwRBQdy3fOYnMUyubw4HZLPlxg8VwTggFbafqzSw.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg_orange.png 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\service.js 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0136865.WMF 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01858_.WMF.1JTVwRBQdy3fOYnMUyubw25WACIICtEsdbM28OtL5m0.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.1JTVwRBQdy3fOYnMUyubwwiOG2lnvDQh5SQEFs-Ep3w.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Maceio.1JTVwRBQdy3fOYnMUyubw7irtCuxFg5artTdJ9rLUQY.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jre7\bin\jawt.dll 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.1JTVwRBQdy3fOYnMUyubw72QKxyXkwlvznJ7GQTYLFc.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00289_.WMF.1JTVwRBQdy3fOYnMUyubw7rtajQU8hgzNA_70OU6D0c.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_fr.dll 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css.1JTVwRBQdy3fOYnMUyubw-_wmGmPKwpZlckDgINSa34.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR44B.GIF 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME47.CSS 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00834_.WMF.1JTVwRBQdy3fOYnMUyubw81jO5wAIKBQn8bCrXIiHEE.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_COL.HXT.1JTVwRBQdy3fOYnMUyubwyn8GebyJe0A5v-KYICVvFk.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2native.dll.1JTVwRBQdy3fOYnMUyubw9-JQKsIzFQIp9EhkhC0OU8.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Program Files\Windows Journal\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\settings.js 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05869_.WMF 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\formautofill@mozilla.org.xpi.1JTVwRBQdy3fOYnMUyubw0hdnT87sDc9kKNIuGgwghA.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00641_.WMF 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\BUTTON.GIF 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_COL.HXC.1JTVwRBQdy3fOYnMUyubw0XXvIRI6yp7tSa46yrULXg.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Windows Sidebar\settings.ini 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0291984.WMF 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0174952.JPG.1JTVwRBQdy3fOYnMUyubw_QFkL7iMJJE_EENXGBw3S4.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15272_.GIF.1JTVwRBQdy3fOYnMUyubw4Ief8daj_hplfX29-PDTUg.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0282932.WMF.1JTVwRBQdy3fOYnMUyubw8cZnkf6f3wvCytf_sUfckw.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341636.JPG.1JTVwRBQdy3fOYnMUyubw0Nw3ksaDkAMc3ddhGkoYmQ.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\flyout.css 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jre7\bin\kcms.dll.1JTVwRBQdy3fOYnMUyubw_PAWxHksRd0tR_rOSk8Ans.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Ojinaga.1JTVwRBQdy3fOYnMUyubw73Db9OMKp8ylHdhQYCxEV0.hive 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\Documents\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\DigitalLocker\fr-FR\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Registration\CRMLog\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http.WebRequest\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Routing\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.IsolatedStorage\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Boot\PCAT\pt-BR\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Help\Help\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MUI\0409\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Linq.Queryable\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\PCHEALTH\ERRORREP\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\assembly\GAC_32\mscorlib\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\XamlBuildTask\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_de_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Context\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Tasks\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Linq\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.ThreadPool\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\PLA\Reports\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Globalization\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\ServiceProfiles\NetworkService\Favorites\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\1031\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition.Registration\v4.0_4.0.0.0__b77a5c561934e089\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Http\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\assembly\GAC_32\ehexthost32\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_de_31bf3856ad364e35\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Primitives\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Numerics\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Controls.Ribbon\v4.0_4.0.0.0__b77a5c561934e089\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Resources\Themes\Aero\Shell\NormalColor\en-US\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Boot\EFI\ko-KR\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\assembly\GAC_64\System.Transactions\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Globalization\MCT\MCT-AU\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1053\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Routing\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MOF\de\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Speech\Engines\Lexicon\ja-JP\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.NameResolution\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.X509Certificates\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Web\Wallpaper\Windows\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\assembly\GAC_64\System.Data.OracleClient\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Globalization\MCT\MCT-CA\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemData\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Input.Manipulations\v4.0_4.0.0.0__b77a5c561934e089\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.v9.0\9.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\DE\HOW_TO_DECRYPT.txt 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 1416 timeout.exe 984 timeout.exe 1920 timeout.exe 1624 timeout.exe 1488 timeout.exe 1764 timeout.exe 1776 timeout.exe 1736 timeout.exe 1488 timeout.exe 904 timeout.exe 1840 timeout.exe 1124 timeout.exe 824 timeout.exe 1056 timeout.exe 1752 timeout.exe 1096 timeout.exe 1388 timeout.exe 980 timeout.exe 1624 timeout.exe 1584 timeout.exe 368 timeout.exe 1848 timeout.exe 1672 timeout.exe 1180 timeout.exe 972 timeout.exe 1924 timeout.exe 288 timeout.exe 608 timeout.exe 1772 timeout.exe 2008 timeout.exe 1924 timeout.exe 1416 timeout.exe 1916 timeout.exe 1116 timeout.exe 1604 timeout.exe 1532 timeout.exe 1732 timeout.exe 2040 timeout.exe 396 timeout.exe 828 timeout.exe 1364 timeout.exe 876 timeout.exe 608 timeout.exe 1924 timeout.exe 1096 timeout.exe 1640 timeout.exe 1780 timeout.exe 1780 timeout.exe 1136 timeout.exe 1916 timeout.exe 1460 timeout.exe 1244 timeout.exe 1392 timeout.exe 1112 timeout.exe 1496 timeout.exe 992 timeout.exe 1500 timeout.exe 1244 timeout.exe 2032 timeout.exe 924 timeout.exe 1780 timeout.exe 1188 timeout.exe 1580 timeout.exe 2032 timeout.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1108 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1468 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1852 vssvc.exe Token: SeRestorePrivilege 1852 vssvc.exe Token: SeAuditPrivilege 1852 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1468 wrote to memory of 636 1468 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe 28 PID 1468 wrote to memory of 636 1468 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe 28 PID 1468 wrote to memory of 636 1468 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe 28 PID 1468 wrote to memory of 636 1468 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe 28 PID 1468 wrote to memory of 1652 1468 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe 30 PID 1468 wrote to memory of 1652 1468 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe 30 PID 1468 wrote to memory of 1652 1468 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe 30 PID 1468 wrote to memory of 1652 1468 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe 30 PID 636 wrote to memory of 1708 636 cmd.exe 33 PID 636 wrote to memory of 1708 636 cmd.exe 33 PID 636 wrote to memory of 1708 636 cmd.exe 33 PID 636 wrote to memory of 1708 636 cmd.exe 33 PID 1652 wrote to memory of 1108 1652 cmd.exe 32 PID 1652 wrote to memory of 1108 1652 cmd.exe 32 PID 1652 wrote to memory of 1108 1652 cmd.exe 32 PID 1652 wrote to memory of 1108 1652 cmd.exe 32 PID 636 wrote to memory of 1944 636 cmd.exe 35 PID 636 wrote to memory of 1944 636 cmd.exe 35 PID 636 wrote to memory of 1944 636 cmd.exe 35 PID 636 wrote to memory of 1944 636 cmd.exe 35 PID 636 wrote to memory of 1532 636 cmd.exe 36 PID 636 wrote to memory of 1532 636 cmd.exe 36 PID 636 wrote to memory of 1532 636 cmd.exe 36 PID 636 wrote to memory of 1532 636 cmd.exe 36 PID 636 wrote to memory of 1680 636 cmd.exe 37 PID 636 wrote to memory of 1680 636 cmd.exe 37 PID 636 wrote to memory of 1680 636 cmd.exe 37 PID 636 wrote to memory of 1680 636 cmd.exe 37 PID 636 wrote to memory of 1180 636 cmd.exe 38 PID 636 wrote to memory of 1180 636 cmd.exe 38 PID 636 wrote to memory of 1180 636 cmd.exe 38 PID 636 wrote to memory of 1180 636 cmd.exe 38 PID 636 wrote to memory of 876 636 cmd.exe 39 PID 636 wrote to memory of 876 636 cmd.exe 39 PID 636 wrote to memory of 876 636 cmd.exe 39 PID 636 wrote to memory of 876 636 cmd.exe 39 PID 636 wrote to memory of 1488 636 cmd.exe 40 PID 636 wrote to memory of 1488 636 cmd.exe 40 PID 636 wrote to memory of 1488 636 cmd.exe 40 PID 636 wrote to memory of 1488 636 cmd.exe 40 PID 636 wrote to memory of 1500 636 cmd.exe 41 PID 636 wrote to memory of 1500 636 cmd.exe 41 PID 636 wrote to memory of 1500 636 cmd.exe 41 PID 636 wrote to memory of 1500 636 cmd.exe 41 PID 636 wrote to memory of 1112 636 cmd.exe 42 PID 636 wrote to memory of 1112 636 cmd.exe 42 PID 636 wrote to memory of 1112 636 cmd.exe 42 PID 636 wrote to memory of 1112 636 cmd.exe 42 PID 636 wrote to memory of 1780 636 cmd.exe 43 PID 636 wrote to memory of 1780 636 cmd.exe 43 PID 636 wrote to memory of 1780 636 cmd.exe 43 PID 636 wrote to memory of 1780 636 cmd.exe 43 PID 636 wrote to memory of 1048 636 cmd.exe 44 PID 636 wrote to memory of 1048 636 cmd.exe 44 PID 636 wrote to memory of 1048 636 cmd.exe 44 PID 636 wrote to memory of 1048 636 cmd.exe 44 PID 636 wrote to memory of 1188 636 cmd.exe 45 PID 636 wrote to memory of 1188 636 cmd.exe 45 PID 636 wrote to memory of 1188 636 cmd.exe 45 PID 636 wrote to memory of 1188 636 cmd.exe 45 PID 636 wrote to memory of 1496 636 cmd.exe 46 PID 636 wrote to memory of 1496 636 cmd.exe 46 PID 636 wrote to memory of 1496 636 cmd.exe 46 PID 636 wrote to memory of 1496 636 cmd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe"C:\Users\Admin\AppData\Local\Temp\88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe_.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\cmd.execmd /c hive.bat >NUL 2>NUL2⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1708
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1944
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1532
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1680
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1180
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:876
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1488
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1500
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1112
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1780
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1048
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1188
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1496
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1924
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1416
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2004
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1136
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:904
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:992
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:952
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1124
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1388
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1608
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1612
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1604
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1580
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1244
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:608
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1192
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:436
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2032
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:824
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1596
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:972
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1840
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1000
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1624
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1668
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1848
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1908
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1732
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1800
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1776
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2008
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2040
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1172
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1924
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1416
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2004
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1136
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:984
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:960
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1116
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1764
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1584
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1736
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:368
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:288
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:592
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:608
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:396
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2032
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:924
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1308
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:996
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1488
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1848
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1916
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1096
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1112
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1780
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1760
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1920
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1116
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1388
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1460
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1584
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1612
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1604
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1364
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:288
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1244
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:516
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:608
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:436
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1056
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1596
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1624
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1308
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1488
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:980
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:112
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1672
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1916
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1772
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1840
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1560
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1392
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1096
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1112
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1780
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1748
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1640
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:672
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1752
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1924
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:828
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c shadow.bat >NUL 2>NUL2⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1108
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1852