Analysis
-
max time kernel
152s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 04:32
Behavioral task
behavioral1
Sample
c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe
Resource
win10v2004-20220901-en
General
-
Target
c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe
-
Size
7KB
-
MD5
0fe9aea31913d392769cc6bf40d2af61
-
SHA1
6caf7328e9abb5ce35dc7a4b3eb39726165f9877
-
SHA256
c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5
-
SHA512
c6c617c069696ffb1e0d8c1381de90deac18ad6551e8ad864a32747d5e065e6054d2bcdf96769bb33c1728402b760abfb70a414ff4ee52aa4aea8182556aa65d
-
SSDEEP
96:V4Zhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihEx5ZWznr1x+V4peJSpNMB:Ozdrr1FG1WDCgmjPZ+zn5criNMUA
Malware Config
Signatures
-
Detected Xorist Ransomware 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1220-55-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral1/memory/1220-56-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 8 IoCs
Processes:
c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exedescription ioc process File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exedescription ioc process File renamed C:\Users\Admin\Pictures\SaveSync.png => C:\Users\Admin\Pictures\SaveSync.png.157953 c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe -
Processes:
resource yara_rule behavioral1/memory/1220-55-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1220-56-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tLYREYsMCZjJ007.exe" c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe -
Drops file in System32 directory 64 IoCs
Processes:
c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\brmfport.inf_amd64_neutral_f41f35e5c21bc350\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\cpu.inf_amd64_neutral_ae5de2e1bf2793c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmti.inf_amd64_neutral_4443b423d18c3ffc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_methods.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_parameters.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_functions_advanced.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc1.inf_amd64_neutral_662220c3016bb4d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\wsdscdrv.inf_amd64_neutral_47406488f9e8d5b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_PSSnapins.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\spp\tokens\channels\OCUR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Foreach.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_FAQ.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Assignment_Operators.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_parameters.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmadc.inf_amd64_neutral_62d6e6995428f9d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\sti.inf_amd64_neutral_9d9a7113099a28a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\faxcn002.inf_amd64_neutral_3d392ccc357e04db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis2u.inf_amd64_neutral_de46607a02fe2552\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_format.ps1xml.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\cs-CZ\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\1394.inf_amd64_neutral_0b11366838152a76\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky305.inf_amd64_ja-jp_4d77cc4802b17ec3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\hr-HR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00b.inf_amd64_neutral_2e6b718b2b177506\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\sdbus.inf_amd64_neutral_735aa3b5ee832f62\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\usbcir.inf_amd64_neutral_379fb0c62496be6e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\wialx002.inf_amd64_neutral_71f4aacee1aa9f06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_For.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\WCN\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_logical_operators.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions_advanced.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\adp94xx.inf_amd64_neutral_4928c8870f6a1577\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_PSSnapins.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\battery.inf_amd64_neutral_cb8fa151a7b7cb80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\prngt003.inf_amd64_neutral_8c9aae54a5673a35\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_CommonParameters.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_debuggers.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Special_Characters.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnso002.inf_amd64_neutral_c3b7ce4e6f71641f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\spp\tokens\pkeyconfig\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_aliases.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_pipelines.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\memory.inf_amd64_neutral_c2d2c213c3138487\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc664.inf_amd64_neutral_673d3dfb961e9b17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky005.inf_amd64_neutral_8836be987024e6a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Break.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Continue.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\bthprint.inf_amd64_neutral_3c11362fa327f5a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer-DRM-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\SysWOW64\sk-SK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\System32\DriverStore\FileRepository\acpipmi.inf_amd64_neutral_256ad642985694b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_hash_tables.help.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe -
Drops file in Program Files directory 64 IoCs
Processes:
c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Premium.gif c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_right.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\PROOF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_Off.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_few-showers.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382944.JPG c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files\Microsoft Games\Minesweeper\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-desk.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_rainy.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149118.JPG c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_disable.gif c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_left.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_top.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_disabled.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent_partly-cloudy.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PAWPRINT.HTM c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files (x86)\Common Files\System\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR39F.GIF c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\HICCUP.WAV c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackgroundRTL.jpg c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03205I.JPG c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_bkg.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382961.JPG c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15173_.GIF c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Module.zip c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe -
Drops file in Windows directory 64 IoCs
Processes:
c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exedescription ioc process File created C:\Windows\Globalization\MCT\MCT-US\RSSFeed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\EN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\winsxs\amd64_hpsamd.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_01d63bab2c631eee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..iles-help.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ec0b349bd61d1d1e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\System.Transactions.resources\2.0.0.0_de_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\GB-wp3.jpg c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data\55389b61c315fb0ad52077f949c7a8dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\inf\MSDTC Bridge 4.0.0.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\winsxs\amd64_divacx64.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d53e24e0c2622251\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_en_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_en_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\Media\Cityscape\Windows Navigation Start.wav c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\winsxs\amd64_mdmcomp.inf_31bf3856ad364e35_6.1.7600.16385_none_aaac94866321a3b9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\System.XML.resources\2.0.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_GlobalResources\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\winsxs\amd64_mdmcxhv6.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_805d2b274b7bd877\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\winsxs\amd64_microsoft-jsintl.resources_31bf3856ad364e35_6.3.9600.16428_en-us_890c3bca68e856fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\Media\Landscape\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\ServiceProfiles\NetworkService\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\system.servicemodel.resources\3.0.0.0_it_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\inf\ASP.NET_4.0.30319\001D\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\Resources\Themes\Aero\Shell\NormalColor\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.1.7601.17514_none_6a4c3ec108e85b6a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Wind5cb9c182#\df5d78a6328636a4ff7bc7992531d6d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.Tasks.Parallel\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\winsxs\amd64_megasas2.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c3bfb650a811e55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\CustomMarshalers\e41fccd68a6543f2528f6f6118f5f7e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Speech\fc1f3019656958a501eb5e410c498d1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\Media\Landscape\Windows Exclamation.wav c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.ComponentModel\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\winsxs\amd64_ehstorpwddrv.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9f92880c5dadd299\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_es_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\System.Workflow.Runtime\3.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\Boot\EFI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\Boot\PCAT\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0409\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\winsxs\amd64_megasr.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6a6a92e6db9172d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_ja_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Web\ea5a0e7af3956d40caeffaab3bb8b753\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp5.jpg c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Runtime\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\ehome\fr-FR\playReady_eula_oem.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\winsxs\amd64_divacx64.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3318a5d3cf471076\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml.84e525b7#\26111428db03f2a918b2deb8029871c4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\Boot\EFI\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.Abstractions.resources\3.5.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\29e00d9446b0496db6e145d3bdfc365a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\diagnostics\system\AERO\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\inf\ASP.NET\001D\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File opened for modification C:\Windows\Media\Delta\Windows Hardware Remove.wav c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\SrpUxSnapIn.resources\6.1.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Services.resources\3.5.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Applicati#\01c92af8d09572a4e4ccb46e3cd71d3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe File created C:\Windows\Boot\EFI\sv-SE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe -
Modifies registry class 10 IoCs
Processes:
c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.157953 c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.157953\ = "BUJYFGNMEYMSLBG" c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BUJYFGNMEYMSLBG c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BUJYFGNMEYMSLBG\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tLYREYsMCZjJ007.exe,0" c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BUJYFGNMEYMSLBG\shell\open\command c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BUJYFGNMEYMSLBG\shell\open c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BUJYFGNMEYMSLBG\ = "CRYPTED!" c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BUJYFGNMEYMSLBG\DefaultIcon c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BUJYFGNMEYMSLBG\shell c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BUJYFGNMEYMSLBG\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tLYREYsMCZjJ007.exe" c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe"C:\Users\Admin\AppData\Local\Temp\c63f9786d11b2dfa7d35f79dfe5001990d64ac9ba78a661048c8823eeb2635a5.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1220