Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-11-2022 16:17
Behavioral task
behavioral1
Sample
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe
Resource
win10v2004-20220901-en
General
-
Target
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe
-
Size
62KB
-
MD5
0210847e1ad4692e9f828528711707a0
-
SHA1
c2500c9587a4f68df63b953aff9e4ffc446ece18
-
SHA256
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7
-
SHA512
acf7a1d304bfc032e64cce4dc5e5fec89f41fc3bea864e29cc3efdcaafcf584646e4b15af3d58126fedc4923b85e74b9a95c7ac5415a2539fcdb0cc6fae582b7
-
SSDEEP
768:w0FmBkpKjJH40+R7WC8If/+w5xZd0vBCn2jd/Pudv0ECjWacQGrtV8PKFWcccPc/:wODKd32Zd6vjVPg0JSaQrtVrFXD6B
Malware Config
Signatures
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process File renamed C:\Users\Admin\Pictures\BlockClose.png => C:\Users\Admin\Pictures\BlockClose.png.EnCiPhErEd 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe -
Drops startup file 1 IoCs
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EOCoth9nO9QJD19.exe" 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe -
Drops file in Program Files directory 64 IoCs
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0177257.JPG 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent_partly-cloudy.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_few-showers.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01213K.JPG 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24ImagesMask.bmp 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_hail.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\Java\jdk1.7.0_80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIcons.jpg 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Empty.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\flyout.html 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10265_.GIF 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14513_.GIF 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\Common Files\Microsoft Shared\VC\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02740G.GIF 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_pressed.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099188.JPG 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0314068.JPG 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\SignedComponents.cer 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_snow.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Windows NT\Accessories\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\activity16v.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR8B.GIF 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\CodeFile.zip 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\Windows NT\Accessories\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21331_.GIF 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR30B.GIF 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099201.GIF 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Form.zip 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\Windows Sidebar\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\settings.html 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\daisies.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099200.GIF 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02503U.BMP 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21400_.GIF 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\THMBNAIL.PNG 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15056_.GIF 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR8F.GIF 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe -
Drops file in Windows directory 64 IoCs
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\cdf48153115fc0bb466f37b7dcad9ac5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\System.Speech.resources\3.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\Media\Cityscape\Windows Default.wav 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\Media\Garden\Windows Default.wav 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\sysglobl\8abe9d895b3e9efe741b9162cb9206fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.IO.Log\85b543fd18ce71c8bc95c49abf8ceb66\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8da3333a#\a36a895bca6339d5f4c8e24db1a00938\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\diagnostics\system\Performance\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp3.jpg 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\inf\MSDTC Bridge 4.0.0.0\0006\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\system.workflow.componentmodel.resources\3.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Workca489553#\361ef62867b1804328cf3616dc8a7f7b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\ehome\es-ES\playready_eula.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0409\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.OracleClient.resources\2.0.0.0_it_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\system.runtime.serialization.resources\3.0.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\78ce3fd89c50ab2d8d0ffc42ad838644\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5cae93d923c8378370758489e5535820\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\diagnostics\system\Device\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\diagnostics\system\Printer\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.WasHosting\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\dc34242bf840d340e94d2657c7c33371\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Printing\836fe321118ff3c6c51adccf758d138b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Speech\0dc049d2993f3d0e2651581533093e17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Principal\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_ja_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\System.XML.resources\2.0.0.0_es_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\AspNetMMCExt\5857dbc9f0d3cb3364728ec72497ece9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\52c68307282a248618376df5db7f9cce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\MMCFxCommon\98b1fc37038b59eb1fcb89ce6284190e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualC\45d6b68ea71f898fee71f67739c5b8a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\IME\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8dc504e4#\53cf54ff35686c4044952a8cf8b8021e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\Help\Help\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\Media\Raga\Windows Logon Sound.wav 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.resources\3.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\TaskScheduler\a3883e7fc1bd0fbc54761b26c2bc5483\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\cd03f7a1d6c4031c515fb3f50c42e268\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Serv43e0ae6e#\be97f3855d5ee65e57f6c510078213d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\Boot\PCAT\zh-TW\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.Extensions.resources\3.5.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\ad18f93fc713db2c4b29b25116c13bd8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\IME\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\inf\ASP.NET\0019\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe -
Modifies registry class 10 IoCs
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "MAFFWRYFBIBLZCO" 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO\ = "CRYPTED!" 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO\DefaultIcon 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EOCoth9nO9QJD19.exe,0" 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO\shell\open\command 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO\shell 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EOCoth9nO9QJD19.exe" 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO\shell\open 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe"C:\Users\Admin\AppData\Local\Temp\0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:896