Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 06:32
Static task
static1
Behavioral task
behavioral1
Sample
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe
-
Size
1.8MB
-
MD5
069170f61d9638c87dab750877065a4a
-
SHA1
21b592ca0ce2e353640893b039eb84dfc7d55d14
-
SHA256
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5
-
SHA512
bb9c4965c5b67b2f1c6190de6daad373bc4cdc7b4c596d50547408447ba9553904ec4e9c49038ef2ffafc80dffcd43462a67d7097ed4bdcce60356da6e73d218
-
SSDEEP
24576:EnA1KgRYWHEvtd8LHhFJpxjMnA1KgRYWHEvtd8LHhFJpxjJ:D1K5ve1K5v
Score
10/10
Malware Config
Signatures
-
LockFile
LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXLIRMV.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarViewButtonImages.jpg d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Windows Media Player\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Microsoft Games\Minesweeper\de-DE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\gadget.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\DVD Maker\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341742.JPG d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBARBLL.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\gadget.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\gadget.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Horizon.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Windows NT\TableTextService\de-DE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Common Files\System\ado\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Windows Photo Viewer\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382925.JPG d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WORDREP.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\PHONE.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Microsoft Games\Solitaire\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL027.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AD.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-awt.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Clarity.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Microsoft Games\Chess\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL002.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\TIME.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.CN.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099167.JPG d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\UIAutomationProvider.resources\3.0.0.0_es_31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.ComponentMod#\560cb6a2e8f4877877b11de7c1f07d42\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\diagnostics\system\WindowsMediaPlayerConfiguration\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\inf\.NET CLR Networking 4.0.0.0\0019\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders\v4.0_4.0.0.0__31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MUI\0409\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\Framework64\1041\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\office\14.0.0.0__71e9bce111e9429c\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\SrpUxSnapIn.resources\6.1.0.0_ja_31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\5d0f494f1be2367fb0a634956f719965\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a7b877#\bc98161a485ea05967844bc0b0c55338\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement.resources\3.5.0.0_de_b77a5c561934e089\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Prefetch\ReadyBoot\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\servicing\Editions\UltimateEdition.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\8.0.0.0__b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\cdb429c8c7738b77dd919b4b917b2078\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b308b9c61f65cf2dfd876031ee385ba4\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\ceff7eae18ed09ff1116ebf9af497790\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity\v4.0_4.0.0.0__b77a5c561934e089\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_de_b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\System.Windows.Presentation.resources\3.5.0.0_it_b77a5c561934e089\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runt9064068c#\afee8437a90f473862f2d364b3669041\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\GAC\es\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ja\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.SqlServerCe\3.5.1.0__89845dcd8080cc91\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\WindowsForm0b574481#\501c549eee2d5c10d2ba0f46aba60f47\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp4.jpg d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0007\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\PLA\Rules\es-ES\Rules.System.Wireless.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_fr_31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\SrpUxSnapIn.resources\6.1.0.0_de_31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\System.Configuration.Install.resources\2.0.0.0_fr_b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\System.Speech.resources\3.0.0.0_de_31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\4436815b432c313255af322f4ec3560d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\ehome\MediaRenderer\MediaCenter.DigitalMediaRenderer.RenderingControl.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1036\eula.rtf d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\PLA\Reports\en-US\Report.System.CPU.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_fr_31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_it_31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_ja_b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Windows.D#\a5daafd496ae30928b7ac626037af53c\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Boot\DVD\EFI\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Resources\Themes\Aero\Shell\NormalColor\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\WindowsBase.resources\3.0.0.0_es_31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\b5a6a5ce3cd3d4dd2b151315c612aeff\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData\v4.0_4.0.0.0__31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\GAC_MSIL\System.Speech\3.0.0.0__31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Boot\PCAT\hu-HU\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\diagnostics\system\AERO\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LOCKFILE d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LOCKFILE\ = "BPFYNFHUWPHNSDE" d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\ = "CRYPTED!" d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\DefaultIcon d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u08hwRO9h74aYk9.exe,0" d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open\command d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u08hwRO9h74aYk9.exe" d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe"C:\Users\Admin\AppData\Local\Temp\d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:880