Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 06:31
Static task
static1
Behavioral task
behavioral1
Sample
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe
-
Size
1.8MB
-
MD5
069170f61d9638c87dab750877065a4a
-
SHA1
21b592ca0ce2e353640893b039eb84dfc7d55d14
-
SHA256
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5
-
SHA512
bb9c4965c5b67b2f1c6190de6daad373bc4cdc7b4c596d50547408447ba9553904ec4e9c49038ef2ffafc80dffcd43462a67d7097ed4bdcce60356da6e73d218
-
SSDEEP
24576:EnA1KgRYWHEvtd8LHhFJpxjMnA1KgRYWHEvtd8LHhFJpxjJ:D1K5ve1K5v
Score
10/10
Malware Config
Signatures
-
LockFile
LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.
-
Drops file in Drivers directory 7 IoCs
Processes:
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exedescription ioc process File created C:\Windows\SysWOW64\drivers\de-DE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\drivers\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\drivers\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe -
Drops startup file 1 IoCs
Processes:
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
Processes:
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exedescription ioc process File created C:\Windows\SysWOW64\en\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-windows-iis-rm\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPC9500S.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\ProfessionalE\license.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomeBasicE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\WCN\de-DE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\StarterE\license.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrg.inf_amd64_neutral_814744dd97ccf09f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\termmou.inf_amd64_neutral_207a02df8e9e6552\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\Enterprise\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasic\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\StarterN\license.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\ProfessionalN\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc7.inf_amd64_neutral_348f512722c79525\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00z.inf_amd64_neutral_aea50acf04a2db1d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\StarterN\license.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\prngt004.inf_amd64_neutral_f5bf8a7ba9dfff55\Amd64\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\wiabr004.inf_amd64_neutral_b1d90b3749c5e6a6\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\HomeBasicE\license.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\ph6xib64c0.inf_amd64_neutral_a43df8f7441e1c61\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomeBasicN\license.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-PerformanceCounterInfrastructure-DL\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_neutral_8f9a8242d3699a44\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcpv.inf_amd64_neutral_5667cca434e3a6b7\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00y.inf_amd64_neutral_64560c72e81f6ad7\Amd64\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\UltimateN\license.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumE\license.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomePremiumE\license.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpsion.inf_amd64_neutral_6e65ea91a16f922a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj4660t.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx002.inf_amd64_neutral_12563574abbc36eb\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj5.inf_amd64_neutral_15940559c66fe8d9\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smf6x4u.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\StarterE\license.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\Starter\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\ja-JP\lipeula.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc003.inf_amd64_neutral_47e09b7cc0d9e993\Amd64\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_neutral_c48d421ad2c1e3e3\tsprint-PipelineConfig.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaky002.inf_amd64_neutral_b898f5982403f3cb\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\wpdcomp.inf_amd64_neutral_11bbf54c8508434e\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomePremiumN\license.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\ts_generic.inf_amd64_neutral_1a5c861fdb3aab0e\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\rdlsbuscbs.inf_amd64_neutral_351e56205fd4c200\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\ja-JP\lpeula.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr00a.inf_amd64_neutral_e7f3f91e6832ef5c\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc6.inf_amd64_neutral_2818f7b3b62bdd39\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpD5400t.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomeBasicN\license.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasicE\license.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\StarterN\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmke.inf_amd64_neutral_3e4daa83122b1559\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00d.inf_amd64_neutral_dd61103f3a2743d4\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\UltimateE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0009\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd7100t.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnky008.inf_amd64_neutral_9f6abc54cbf095f2\Amd64\KYW7QUR7.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\_Default\EnterpriseN\license.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc10.inf_amd64_neutral_2c5d0c618dbfaf2a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe -
Drops file in Program Files directory 64 IoCs
Processes:
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exedescription ioc process File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Microsoft Games\Chess\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALENDAR.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Java\jre7\lib\cmm\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\default_thumb.jpg d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382952.JPG d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387591.JPG d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\XmlFile.zip d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341559.JPG d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Angles.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Microsoft Games\More Games\de-DE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Microsoft Games\Minesweeper\de-DE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN109.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN022.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN020.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382931.JPG d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313970.JPG d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\gadget.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\MediaReceiverRegistrar.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\ProPlusWW.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341439.JPG d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe -
Drops file in Windows directory 64 IoCs
Processes:
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exedescription ioc process File created C:\Windows\winsxs\amd64_microsoft-windows-c..tasp1.res.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fa439221677daa02\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-langreg.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2c40e6785093a2ba\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_dce16aae319c9009\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..direction.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_759b4c9d445c02aa\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.DirectorySer#\6ed2b26c49820b85b9f78ac7abceefa9\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_mdmbtmdm.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_af17a416dc74fd47\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dot3gpui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_77e2e9495a65faed\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..tvratings.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8358aa274f88ac93\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-medctr.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4144648064d252c2\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sort.resources_31bf3856ad364e35_6.1.7600.16385_es-es_416a2087e14e0ef1\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1037\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..n-clients.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4a8cc9d85145473a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_flpydisk.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9ec97a7bd8b53136\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-tablet.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c1c73d3a91d32fe3\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..plistener.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8e703c5ae3409d42\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-blb-engine-proxy-main_31bf3856ad364e35_6.1.7600.16385_none_0097b8874cf224a3\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..elsupport.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c8b14f4212bb6712\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-keymgr.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4a1ba1c059f01e88\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-epgtos.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_cc39e164ed9f744a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ff6f7ad3c2f5987e\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\UIAutomationClientsideProviders\3.0.0.0__31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..orecodecs.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_42944333cf641a7b\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..statement.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_30da4a65071b6499\vofflps.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..rkprofile.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_380b3cd831c11861\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-winmeetb.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a7c171d703df75b5\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..t-starter.resources_31bf3856ad364e35_6.1.7601.17514_it-it_9aff0a0726ff98b6\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..peeradmin.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fe48b981d15ccc3f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..trolpanel.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_eed392960027a512\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sxs.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f048f28192785243\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sysprep.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0fed1b287a2c3c87\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..serverapi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a49b7e6132aa852d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fdeploy-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bc8aa1182c0653a6\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ndisuio.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4f5709eb6a463a26\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-stickynotes.resources_31bf3856ad364e35_6.1.7600.16385_en-us_567f6e855a658d02\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tunnel.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5f551ffa4ca67697\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-photoviewer.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d262dfac611d6db9\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-stickynotes-licensing_31bf3856ad364e35_6.1.7600.16385_none_1087c6224049e89e\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Workca489553#\336025d8c78c7f996af8ab8aac278688\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_agp.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c1d2a33730aa56a6\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehepgres_31bf3856ad364e35_6.1.7600.16385_none_2b88e25b231bddb9\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\inf\.NET Data Provider for SqlServer\040C\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_6.1.7600.16385_de-de_83e1d091bc0e4461\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iconcodecservice_31bf3856ad364e35_6.1.7600.16385_none_832d9574a3c54749\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-windowsmediadrm-adm_31bf3856ad364e35_6.1.7600.16385_none_0b447ce583a5f8fe\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_6.1.7601.17514_none_2d1a84c49beb2055\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..eady_eula.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_38563db42d064525\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-appman.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_78726d038f779639\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-efsfull.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b442345b65df4b0c\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1b261b1fba1c79a5\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rpc-http_31bf3856ad364e35_6.1.7601.17514_none_fe1ef25f55f373ef\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..repairbde.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_03d529c1f8c80195\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Algorithms\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\1033\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e8934bff7a284e2f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fdeploy-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e4c982e87fe24881\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..migration.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e93cd283836c7497\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-u..lsettings.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_cab3e22a2a611f58\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-devtools_31bf3856ad364e35_11.2.9600.16428_none_1dfc1fde54e48fcd\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..35cdfcomp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0267af49be0713f6\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tunnel_31bf3856ad364e35_6.1.7601.17514_none_01900e7d9b53e4bb\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe -
Modifies registry class 10 IoCs
Processes:
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LOCKFILE\ = "BPFYNFHUWPHNSDE" d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\ = "CRYPTED!" d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u08hwRO9h74aYk9.exe" d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LOCKFILE d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\DefaultIcon d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u08hwRO9h74aYk9.exe,0" d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open\command d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe"C:\Users\Admin\AppData\Local\Temp\d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:900
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/900-54-0x0000000075571000-0x0000000075573000-memory.dmpFilesize
8KB