Analysis
-
max time kernel
151s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-07-2022 11:02
Static task
static1
Behavioral task
behavioral1
Sample
4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe
Resource
win10v2004-20220414-en
General
-
Target
4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe
-
Size
346KB
-
MD5
99df60e4e6bd3497f40736a408dd0a46
-
SHA1
d02937c29a00c4d15fbcb19a9afd85a9ad3fce6b
-
SHA256
4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f
-
SHA512
aa902f62c05b5682209459d354dc70d243125612fff1000879b5ee0d32b58c8b503a140942376483ad41de4c4d29502bf3f3f92a4a910418f9af3b5cf6671f32
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\HOW TO DECRYPT FILES.txt
repair_data@scryptmail.com
3KxEZKjS4ifAHhX2o1fq9tERkAshSgA4hg
https://coinatmradar.com/
https://www.localbitcoins.com/
Signatures
-
Detected Xorist Ransomware 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1932-57-0x0000000000400000-0x0000000000465000-memory.dmp family_xorist behavioral1/memory/1932-58-0x0000000000400000-0x0000000000465000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exedescription ioc process File renamed C:\Users\Admin\Pictures\CheckpointUnpublish.tif => C:\Users\Admin\Pictures\CheckpointUnpublish.tif....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_YOU_NEED_TO_PURCHASE_THE_DECRYPTOR_FROM_US_FAST_AND_URGENT 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File renamed C:\Users\Admin\Pictures\InstallLock.crw => C:\Users\Admin\Pictures\InstallLock.crw....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_YOU_NEED_TO_PURCHASE_THE_DECRYPTOR_FROM_US_FAST_AND_URGENT 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File renamed C:\Users\Admin\Pictures\InvokeWrite.tif => C:\Users\Admin\Pictures\InvokeWrite.tif....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_YOU_NEED_TO_PURCHASE_THE_DECRYPTOR_FROM_US_FAST_AND_URGENT 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\Pictures\SearchUndo.tiff 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File renamed C:\Users\Admin\Pictures\SearchUndo.tiff => C:\Users\Admin\Pictures\SearchUndo.tiff....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_YOU_NEED_TO_PURCHASE_THE_DECRYPTOR_FROM_US_FAST_AND_URGENT 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File renamed C:\Users\Admin\Pictures\TraceCopy.png => C:\Users\Admin\Pictures\TraceCopy.png....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_YOU_NEED_TO_PURCHASE_THE_DECRYPTOR_FROM_US_FAST_AND_URGENT 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File renamed C:\Users\Admin\Pictures\WaitRedo.tif => C:\Users\Admin\Pictures\WaitRedo.tif....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_YOU_NEED_TO_PURCHASE_THE_DECRYPTOR_FROM_US_FAST_AND_URGENT 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe -
Drops startup file 2 IoCs
Processes:
4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\02130ye0T5GMhu3.exe" 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Public\Videos\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VRG14UW3\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Globalization\MCT\MCT-US\Link\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\Links\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Fonts\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Globalization\MCT\MCT-GB\Link\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\8WU7A3BP\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\Music\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Public\Documents\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Globalization\MCT\MCT-US\Wallpaper\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\PWZ8QZ9F\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D396AG1W\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exedescription ioc process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe -
Drops file in Program Files directory 64 IoCs
Processes:
4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwinhibit_plugin.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Windows Photo Viewer\PhotoAcq.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\calendar.html 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageSlice.gif 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\es-ES\msaddsr.dll.mui 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2native.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\highDpiImageSwap.js 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdate.exe 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10254_.GIF 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099186.JPG 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONPPTAddin.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Java\jre7\bin\jaas_nt.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmicrodns_plugin.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new_partly-cloudy.png 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCH.DLL 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145212.JPG 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OWSSUPP.DLL 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\gadget.xml 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Program Files\Windows Sidebar\es-ES\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14801_.GIF 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\picturePuzzle.html 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\oledb32r.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\TAB_ON.GIF 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\MDIParent.zip 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.png 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwjpnr.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-gibbous_partly-cloudy.png 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Program Files\DVD Maker\ja-JP\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_mmx_plugin.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous.png 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_alignleft.gif 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\service.js 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_settings.png 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_pressed.png 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe -
Drops file in Windows directory 64 IoCs
Processes:
4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exedescription ioc process File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt93d54979#\da2c6b516aa1681ed943b187b9c36c05\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\diagnostics\system\Power\RS_DisableUSBSelective.ps1 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\inf\secrecs.inf 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Services.Design.resources\3.5.0.0_es_b77a5c561934e089\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement.resources\3.5.0.0_es_b77a5c561934e089\System.DirectoryServices.AccountManagement.resources.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.DynamicData.resources\3.5.0.0_it_31bf3856ad364e35\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Fonts\upcki.ttf 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Management.Instrumentation\3.5.0.0__b77a5c561934e089\System.Management.Instrumentation.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\45d49301a9e8ff19669155b1ec5c45ce\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\diagnostics\system\AERO\de-DE\DiagPackage.dll.mui 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Fonts\8514sys.fon 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\GAC_MSIL\system.identitymodel.resources\3.0.0.0_ja_b77a5c561934e089\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.resources\2.0.0.0_de_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\d9a485330ec2708456134e4a9712a4ab\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\6682e8964200a1336f1dbe49392f7797\System.EnterpriseServices.ni.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_ja_31bf3856ad364e35\EventViewer.resources.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_de_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_fr_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Contract.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\diagnostics\system\Audio\en-US\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Fonts\courbi.ttf 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\inf\MSDTC Bridge 3.0.0.0\_TransactionBridgePerfCounters.h 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\ehome\mcetuningoverrides.xml 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Fonts\vgasysr.fon 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_it_b03f5f7f11d50a3a\Microsoft.Build.Utilities.Resources.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_fr_31bf3856ad364e35\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Workca489553#\336025d8c78c7f996af8ab8aac278688\System.Workflow.ComponentModel.ni.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\diagnostics\system\Networking\NetworkDiagnosticsVerify.ps1 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Fonts\constani.ttf 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\inf\mchgr.inf 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\GAC_MSIL\system.workflow.componentmodel.resources\3.0.0.0_it_31bf3856ad364e35\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\0af51d481e7c0a48e0fb5164e38e9465\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\diagnostics\system\Power\RS_Balanced.ps1 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\ehome\McxTask.exe 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\diagnostics\system\Audio\fr-FR\DiagPackage.dll.mui 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\ehome\de-DE\ehchhime.dll.mui 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Globalization\MCT\MCT-US\Wallpaper\desktop.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\inf\MSDTC Bridge 4.0.0.0\001D\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_ja_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\MMCEx\b46af15d2e2ae2782f384bfc4a4c2c03\MMCEx.ni.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Fonts\simpbdo.ttf 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\inf\.NET CLR Networking 4.0.0.0\0804\_Networkingperfcounters.ini 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\MMCEx.Resources.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\ehome\mcspad.exe 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Fonts\svgasys.fon 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\inf\netnvm64.inf 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf293040f3a93afa1ea782487acae816\WindowsBase.ni.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Boot\PCAT\it-IT\memtest.exe.mui 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Fonts\cordiaub.ttf 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.resources.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_es_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_fr_31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\inf\apps.inf 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\inf\prnep003.inf 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\Help\Help\es-ES\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File created C:\Windows\inf\aspnet_state\0007\HOW TO DECRYPT FILES.txt 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Editor.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_fr_31bf3856ad364e35\PresentationCore.resources.dll 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\diagnostics\system\Device\CL_Utility.ps1 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe File opened for modification C:\Windows\Fonts\segoeprb.ttf 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe -
Modifies registry class 10 IoCs
Processes:
4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_YOU_NEED_TO_PURCHASE_THE_DECRYPTOR_FROM_US_FAST_AND_URGENT\ = "GZEIZJTHTUXIBXE" 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GZEIZJTHTUXIBXE\shell\open\command 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GZEIZJTHTUXIBXE\shell 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_YOU_NEED_TO_PURCHASE_THE_DECRYPTOR_FROM_US_FAST_AND_URGENT 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GZEIZJTHTUXIBXE 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GZEIZJTHTUXIBXE\ = "CRYPTED!" 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GZEIZJTHTUXIBXE\DefaultIcon 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GZEIZJTHTUXIBXE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\02130ye0T5GMhu3.exe,0" 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GZEIZJTHTUXIBXE\shell\open 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GZEIZJTHTUXIBXE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\02130ye0T5GMhu3.exe" 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe"C:\Users\Admin\AppData\Local\Temp\4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\desktop.iniFilesize
129B
MD5102809ec948569f9f6975c03d7e3e689
SHA16c0be287ad1d680ea9593c3266cb9d5f1a073a2b
SHA256aaf90b204a8909085e56a7783b67b9bb241cb8b95c9106d5ddea17765eab10ef
SHA5125bea7ba76f2d00a2cdac3135b92e65b1a224a7a57b63b0d64d9f1826c30e73ab967b39275170f4367d3eb30b625e3f1be9aa10910fc6748f92e443bf2fdf8284
-
memory/1932-54-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/1932-56-0x0000000000220000-0x0000000000241000-memory.dmpFilesize
132KB
-
memory/1932-57-0x0000000000400000-0x0000000000465000-memory.dmpFilesize
404KB
-
memory/1932-58-0x0000000000400000-0x0000000000465000-memory.dmpFilesize
404KB