Analysis
-
max time kernel
151s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 04:32
Behavioral task
behavioral1
Sample
d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe
Resource
win10v2004-20220901-en
General
-
Target
d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe
-
Size
7KB
-
MD5
0e23d1a8ca65a4067e50718305cd8956
-
SHA1
3d85d49bc151777e6553953dadd798fea00a8d15
-
SHA256
d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211
-
SHA512
83ff6076fe686313f5872371f3ca719d8fca460fca4f83e42c458b6644ae605bf7e36c0e7a9d9d473bcb86cda05c6c4953a493d79e0a5e9612e55e43389b9eba
-
SSDEEP
192:Szdrr1FG1WDCgmjPZUy9mNIFM5wQGyMUA:Sprr1gkDCgSMIFMVXMB
Malware Config
Signatures
-
Detected Xorist Ransomware 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1464-55-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral1/memory/1464-56-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 8 IoCs
Processes:
d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exedescription ioc process File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exedescription ioc process File renamed C:\Users\Admin\Pictures\ExitRequest.png => C:\Users\Admin\Pictures\ExitRequest.png.EnCiPhErEd d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe -
Processes:
resource yara_rule behavioral1/memory/1464-55-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1464-56-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e2I44i200Tf2UUn.exe" d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe -
Drops file in System32 directory 64 IoCs
Processes:
d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\af9035bda.inf_amd64_neutral_aa11aa34552d1d4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions_advanced_methods.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_pipelines.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_objects.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Ref.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\prnin003.inf_amd64_neutral_3a3c6293d0cda862\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Path_Syntax.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\migwiz\PostMigRes\data\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_functions_advanced.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_WMI_Cmdlets.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_properties.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc1.inf_amd64_neutral_662220c3016bb4d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\prnle004.inf_amd64_neutral_beb9bf23b7202bff\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_providers.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_escape_characters.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_neutral_8887242a56ee027e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_transactions.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_PSSnapins.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_join.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_providers.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\wsdscdrv.inf_amd64_neutral_47406488f9e8d5b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\migration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_output.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\Dism\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa3.inf_amd64_neutral_77e515342bd572cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\lt-LT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\tape.inf_amd64_neutral_c6a6811d3d827dba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Reserved_Words.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbus.inf_amd64_neutral_fca91999602b0343\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_arrays.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_hash_tables.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_PSSnapins.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\wiabr007.inf_amd64_neutral_442d902f3f3dd5b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Windows_PowerShell_ISE.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmlasat.inf_amd64_neutral_bc1469ba40fe2114\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsier.inf_amd64_neutral_622ad8125bbeeda8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\prnkm003.inf_amd64_neutral_48652cda3bb15180\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc005.inf_amd64_neutral_31e08a1c2f933124\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00v.inf_amd64_neutral_86ff307c66080d00\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions_cmdletbindingattribute.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_neutral_6708ad28050a6765\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_troubleshooting.help.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr006.inf_amd64_neutral_f156853def526447\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\vhdmp.inf_amd64_neutral_c3910bbf4fbccf97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe -
Drops file in Program Files directory 64 IoCs
Processes:
d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exedescription ioc process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_right.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01770_.GIF d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\background.gif d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR1F.GIF d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR37F.GIF d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files\Windows Mail\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR14F.GIF d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR51B.GIF d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR36F.GIF d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\settings.html d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\30.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_cloudy.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_thunderstorm.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files\Microsoft Games\Purble Place\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files\VideoLAN\VLC\lua\http\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\THMBNAIL.PNG d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR10F.GIF d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02503U.BMP d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115835.GIF d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)alertIcon.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143758.GIF d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\flyoutBack.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent_partly-cloudy.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01740_.GIF d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImagesMask.bmp d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImages.jpg d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile16.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382966.JPG d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_rest.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe -
Drops file in Windows directory 64 IoCs
Processes:
d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exedescription ioc process File created C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00010405_31bf3856ad364e35_6.1.7601.17514_none_ea4c8a7b6c447320\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..dle-agent.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b0a1e1063fb5f82c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Permission\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\e7873d3bd71f6122c2a954be1bb5bb28\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_mcx2.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_7ef257239c51276f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..airingdll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_a87d598a550527ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dns-client.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_bb763253eb8e2ed8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..soundthemes-savanna_31bf3856ad364e35_6.1.7600.16385_none_8501e89d0b011992\Windows Hardware Remove.wav d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_netk57a.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d23369cf2577d24a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_7b03114f7abc87df\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\3.5.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ringtonesamples_31bf3856ad364e35_6.1.7600.16385_none_135e536ebbe59c28\Ringtone 03.wma d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..duler-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6904b36cd8dc2d43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_prnok002.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b5bcff3a2ba7118b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-artcon3.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_752be5367271f3cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..trolpanel.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_61fa3c0ba91bfb64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-netevent.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6b28381f9f734bbc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-onex-mof_31bf3856ad364e35_6.1.7601.17514_none_bca1e78283035a8c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_prnep00l.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b4aa016ba6df7434\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..torserver.resources_31bf3856ad364e35_6.1.7601.17514_en-us_1899cfb8311e6a05\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_prnnr002.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_97944986f3c7572f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f45f016e4717aa89\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eudcedit.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a23f4c127f87c066\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_de-de_0bf13b9c8eefa5a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_es-es_101d52bed2c0d719\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-recdisc-main.resources_31bf3856ad364e35_6.1.7600.16385_en-us_05edae120b0fab4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..cy-engine.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_508fcede0c563f82\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..rpautoreg.resources_31bf3856ad364e35_6.1.7600.16385_it-it_672be8a37ae626bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..ienttools.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d9200a4dbea820f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.Routing.resources\3.5.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.AddIn.Contra#\eadb7dd5fe85da92b491154484bc40e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_mdmcodex.inf_31bf3856ad364e35_6.1.7600.16385_none_276f44de5e8e7007\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..ltimateed.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0593bc3c44f89478\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00020437_31bf3856ad364e35_6.1.7600.16385_none_8c1c84c0615562b0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Deployment\d6dc141d56f9c6624e1f60bf6f3d457b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mspaint.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_bade742ca09c2c63\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..calmediadisc-styles_31bf3856ad364e35_6.1.7600.16385_none_dac1eab162daeb45\Heart_SelectionSubpicture.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..ingwizard.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0f1d141626d4168f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-takeown_31bf3856ad364e35_6.1.7601.17514_none_58116b392c3da43c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-time-service.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aefabe79adcea8c7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\settings_divider_right.png d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1d470ceb8c4a0ba8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_nb-no_cb3c4208cb85a715\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_prnbr008.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_53867e031a4f43db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-fstexp.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c697604864cd4282\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-standardvga_31bf3856ad364e35_6.1.7600.16385_none_f881232cf3b0c322\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..r-tlntsvr.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_50bfdec5a4bd0a53\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winrsplugins.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b81618a9cd0f7ae8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-x..ocess-mui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_50863b6e8dfa0a07\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f86c44a49a61f132\slideShow.html d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_6.1.7600.16385_none_b9e4f3b6220df5e7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..adisc-style-babyboy_31bf3856ad364e35_6.1.7600.16385_none_f13596916b261f67\BabyBoyMainBackground.wmv d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-shell-soundthemes-raga_31bf3856ad364e35_6.1.7600.16385_none_2fe300bf8e73cdbd\Windows Pop-up Blocked.wav d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_machine.inf.resources_31bf3856ad364e35_6.1.7601.17514_de-de_fa4240eb15c724f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-documents-performance_31bf3856ad364e35_6.1.7600.16385_none_3cdadc249cb267a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\500-16.htm d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-qwave.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_017b6ee6d82e017a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..ion-agent.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0432f296d313ee9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe File created C:\Windows\winsxs\amd64_security-malware-wi..-defender.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ed4b155baa9f0415\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe -
Modifies registry class 10 IoCs
Processes:
d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DSRHMQACJKQPLWP d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DSRHMQACJKQPLWP\shell d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DSRHMQACJKQPLWP\shell\open d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DSRHMQACJKQPLWP\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e2I44i200Tf2UUn.exe" d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "DSRHMQACJKQPLWP" d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DSRHMQACJKQPLWP\ = "CRYPTED!" d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DSRHMQACJKQPLWP\DefaultIcon d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DSRHMQACJKQPLWP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e2I44i200Tf2UUn.exe,0" d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DSRHMQACJKQPLWP\shell\open\command d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe"C:\Users\Admin\AppData\Local\Temp\d1caaaef83891f6d7b60a0acff4cea5fab6632942efef71dd8d53df07ec67211.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1464