Analysis
-
max time kernel
153s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 04:32
Behavioral task
behavioral1
Sample
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe
Resource
win10v2004-20220901-en
General
-
Target
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe
-
Size
24KB
-
MD5
04fee8ac111c10660178f4ddbc1f17c9
-
SHA1
57eb1390e539144d87bb4bb3c1c2c5103b50a819
-
SHA256
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84
-
SHA512
c9932414ee16ca5b3bbcb003f4646af23186d23b4ffdee6243638b1dee05ce703f0b45fba17017b87a250ee286a0a47dcf2d5a71524bdd5b86205be1c5bd54fe
-
SSDEEP
384:Dprr1gkDCgSs77F9saOxj8uO9G+WkA5WuHVdR4cWNB:FrVDCu7Ol8uB+WkAn/WX
Malware Config
Signatures
-
Detected Xorist Ransomware 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1020-55-0x0000000000400000-0x0000000000414000-memory.dmp family_xorist behavioral1/memory/1020-56-0x0000000000400000-0x0000000000414000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 8 IoCs
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process File renamed C:\Users\Admin\Pictures\ExportWatch.png => C:\Users\Admin\Pictures\ExportWatch.png.EnCiPhErEd 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe -
Processes:
resource yara_rule behavioral1/memory/1020-55-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1020-56-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kg4SQNj6ADx9boQ.exe" 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe -
Drops file in System32 directory 64 IoCs
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_troubleshooting.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00z.inf_amd64_neutral_aea50acf04a2db1d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_escape_characters.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Comment_Based_Help.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Throw.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfport.inf_amd64_neutral_f41f35e5c21bc350\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmar1.inf_amd64_neutral_b8ebf59556c3dbf0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmbsb.inf_amd64_neutral_56a9f6bceeec7f72\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\com\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_neutral_8f9a8242d3699a44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_output.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrf.inf_amd64_neutral_439e7d1dcac00aca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00e.inf_amd64_neutral_0a4797d9b127d3a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_arrays.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr003.inf_amd64_neutral_dff45d1d0df04caf\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\migration\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00y.inf_amd64_neutral_64560c72e81f6ad7\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Special_Characters.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc9.inf_amd64_neutral_ff3a566e4b6ba035\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\tdibth.inf_amd64_neutral_6ad685957123daf1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_preference_variables.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmx5560.inf_amd64_neutral_e853cea0022c059a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\WCN\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_environment_variables.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Variables.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\bg-BG\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmiodat.inf_amd64_neutral_839e9ee1a8736613\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\pl-PL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmbr002.inf_amd64_neutral_ce2134188ab21f59\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_properties.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Redirection.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\prnin002.inf_amd64_neutral_977d40799168c216\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky005.inf_amd64_neutral_8836be987024e6a9\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_debuggers.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Ref.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_neutral_86bb50f34c49ae71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr007.inf_amd64_neutral_add2acf1d573aef0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00g.inf_amd64_neutral_2926840e245f88f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc10.inf_amd64_neutral_2c5d0c618dbfaf2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_types.ps1xml.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmrock5.inf_amd64_neutral_cadd97421d121ebb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Return.help.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe -
Drops file in Program Files directory 64 IoCs
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process File created C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_drop_shadow.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Filters\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\43.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR6F.GIF 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\SignedComponents.cer 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_windy.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH00601G.GIF 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\THMBNAIL.PNG 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382966.JPG 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_right.gif 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignleft.gif 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_few-showers.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01839_.GIF 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14692_.GIF 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\10.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarViewButtonImages.jpg 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIcons.jpg 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Windows Media Player\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Java\jre7\lib\cmm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Java\jre7\lib\zi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-desk.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Microsoft Games\Chess\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-hot.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099157.JPG 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099189.JPG 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\macroprogress.gif 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_right.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0283209.GIF 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_OFF.GIF 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\35.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Microsoft Games\More Games\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21312_.GIF 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21326_.GIF 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CHECKBOX.JPG 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\icon.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\18.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR1F.GIF 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe -
Drops file in Windows directory 64 IoCs
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process File created C:\Windows\winsxs\amd64_mdmmoto1.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fa7a63ef9bf8c237\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..quota-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ca7476b12667c868\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..-base-mof.resources_31bf3856ad364e35_6.1.7600.16385_es-es_fc6a78e5bdbe64a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\btn_search_down_BIDI.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_blue_partly-cloudy.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-presset.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a651490d16f08ad7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Reflc3377498#\85dc7be3ec25fc20a135f3f2dd34192e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..lter-mime.resources_31bf3856ad364e35_7.0.7600.16385_ja-jp_bb0d79a2cc76d9bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xaml\76a6a6b0f7fb1fbd64a800b5fc3d47bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..ingconfig.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_698a4a0ff29b819e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\78ce3fd89c50ab2d8d0ffc42ad838644\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-advpack.resources_31bf3856ad364e35_8.0.7600.16385_fr-fr_5059d8e68c48e340\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-atbroker.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1a3d2559592988bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_6.1.7601.17514_none_d4c5c995fb3f4a1b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-autoconv.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_05418eada7acee76\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_ce76f352fa54bd75\9.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-bitlock.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_cad93454e0243f33\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8734fb86705288a7\RSSFeeds.html 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\Media\Afternoon\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\Media\Windows Pop-up Blocked.wav 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\Web\Wallpaper\Landscapes\img9.jpg 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_mdmbr004.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4d111aeb5a5ad44b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-epgtos.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_588756b8b7ec6ba3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\cronometer_settings.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\undocked_black_moon-waxing-crescent_partly-cloudy.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\AppPatch\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.OracleClient.resources\2.0.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.AddIn\a7bc3b42b60c8eaa28b5b62900c9027f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Common\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..-enforcement-client_31bf3856ad364e35_6.1.7600.16385_none_3efbe964e010a5aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..presenter.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e337b625fbb72d45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-storage.resources_31bf3856ad364e35_6.1.7600.16385_de-de_63ad89d168b082fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_mdmrock4.inf_31bf3856ad364e35_6.1.7600.16385_none_7b8f5b21b658885d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bits-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_25a039f02b6b9e84\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Uti#\8ce46e3ffce2d37b9c50762a641c57ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Data.Services\0765c6422b48cd504d2fba3765c78c79\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_acpipmi.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ac3f0fa9fc5c60ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_bthspp.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4b44e83206eeb2a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_ks.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2210d61f3a539c0e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_dot4prt.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_3bed9fd92957f7e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dfsui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a8d828df9db05504\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..putername.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5f7fc29722da787f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-peopcom.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_920a8028f699d51f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Security\8391072310ccd84eecefe797cfd4a4a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..oldertool.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6f10a4f0b435b03f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-credssp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_eaee1bbccc2029c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-cryptsp-dll_31bf3856ad364e35_6.1.7600.16385_none_85525fb4207d890f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehentt.resources_31bf3856ad364e35_6.1.7600.16385_es-es_fec5fb9f6c0789d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-bitlock.resources_31bf3856ad364e35_6.1.7600.16385_en-us_28566171ed2b372c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-sniptoo.resources_31bf3856ad364e35_6.1.7600.16385_it-it_82dacdd59c68b3f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\Media\Characters\Windows Critical Stop.wav 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\Media\Raga\Windows Pop-up Blocked.wav 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..-devices-xeikaimage_31bf3856ad364e35_6.1.7600.16385_none_ccef70ff13b9d087\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-artui2.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c268d7431b8e4c0f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-diskmgt.resources_31bf3856ad364e35_6.1.7600.16385_de-de_db5270dbc693dafe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MOF\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-aero_ss.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f0d463d4d79d7a05\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..gine-main.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7d0b430f54c619cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe -
Modifies registry class 10 IoCs
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\DefaultIcon 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\shell 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kg4SQNj6ADx9boQ.exe" 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\shell\open 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "QMVTCUODNBQPFQJ" 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\ = "CRYPTED!" 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kg4SQNj6ADx9boQ.exe,0" 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\shell\open\command 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe"C:\Users\Admin\AppData\Local\Temp\9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1020