Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
20-11-2022 02:33
Behavioral task
behavioral1
Sample
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe
Resource
win10v2004-20220901-en
General
-
Target
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe
-
Size
164KB
-
MD5
15039abc55ac99be0247c70d51482ed4
-
SHA1
f8c1169174ef77542c8951229e338a2dab3e54f8
-
SHA256
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d
-
SHA512
7c4da14da92e89dd8f06bc0f0a9ceaf490e479dd41192a4d0c69cbd60564546b559ea7852bb42f66eb505aa7b3c690ec6b3c736b2792b834e5072b6c9ffbe630
-
SSDEEP
3072:MLs3F0jdrUa3Z3TVixrZ2O1l6ZSOSVU2g//MdCglw5Euv1Ft5MM1o3u64DE:gQF0JIgZ3T0Z2aimHg//bglEN/IedD
Malware Config
Signatures
-
Detected Xorist Ransomware 3 IoCs
Processes:
resource yara_rule behavioral1/memory/572-65-0x0000000000400000-0x00000000004C2000-memory.dmp family_xorist behavioral1/memory/572-66-0x0000000000400000-0x00000000004C2000-memory.dmp family_xorist behavioral1/memory/572-67-0x0000000000400000-0x00000000004C2000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 1 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Processes:
resource yara_rule behavioral1/memory/656-55-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/572-57-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/572-59-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/572-60-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/572-64-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/572-65-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/572-66-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/572-67-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\34EeU833qyc18xe.exe" 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Drops file in System32 directory 64 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription ioc process File opened for modification C:\Windows\System32\catroot2\dberr.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_WMI_Cmdlets.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_type_operators.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Line_Editing.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_requirements.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_output.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_If.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Switch.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Core_Commands.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Comparison_Operators.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_properties.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_pssessions.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_pssession_details.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_command_precedence.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_data_sections.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_scripts.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Quoting_Rules.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Session_Configurations.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_do.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_logical_operators.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_transactions.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_prompts.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Quoting_Rules.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_script_internationalization.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_preference_variables.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_do.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_hash_tables.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Windows_PowerShell_ISE.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Redirection.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_parameters.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote_FAQ.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Switch.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\WindowsMovieMaker.bmp 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Break.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Arithmetic_Operators.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Line_Editing.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_job_details.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Signing.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Line_Editing.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_split.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_script_internationalization.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\WindowsPhotoGallery.bmp 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_History.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_job_details.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_functions_advanced_methods.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_requires.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_type_operators.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Ref.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_requirements.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_scopes.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_wildcards.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_functions.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_WMI_Cmdlets.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_pssession_details.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_debuggers.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_execution_policies.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Return.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Core_Commands.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_arrays.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_split.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Reserved_Words.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_wildcards.help.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription pid process target process PID 656 set thread context of 572 656 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Drops file in Program Files directory 64 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription ioc process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile16.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\picturePuzzle.html 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_settings.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-dock.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099148.JPG 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14528_.GIF 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_justify.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_left.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_sun.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Common Files\Services\verisign.bmp 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DATE.JPG 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\15.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\PREVIEW.GIF 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341534.JPG 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\ViewHeaderPreview.jpg 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Casual.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\UnblockRequest.mp4 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\BOMB.WAV 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_left.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\blank.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_cloudy.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14654_.GIF 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15155_.GIF 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImagesMask.bmp 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\IconImagesMask.bmp 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_top.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Earthy.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_hov.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PINELUMB.JPG 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImagesMask.bmp 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_ON.GIF 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\THROAT.WAV 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_GreenTea.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\SettingsInternal.zip 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01770_.GIF 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CHECKBOX.JPG 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked-loading.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_s.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15022_.GIF 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImageMask.bmp 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Drops file in Windows directory 64 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription ioc process File opened for modification C:\Windows\Media\Calligraphy\Windows Logon Sound.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Delta\Windows Hardware Remove.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Garden\Windows Hardware Insert.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Web\Wallpaper\Scenes\img25.jpg 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Windows Minimize.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\ehome\ja-JP\playReady_eula_oem.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Web\Wallpaper\Characters\img21.jpg 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..eady_eula.resources_31bf3856ad364e35_6.1.7600.16385_es-es_959ec7b53a342ec3\playReady_eula_oem.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Sonata\Windows Hardware Remove.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Windows Battery Critical.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Cityscape\Windows Battery Critical.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Cityscape\Windows User Account Control.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Festival\Windows Critical Stop.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Festival\Windows Pop-up Blocked.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Calligraphy\Windows Battery Low.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Cityscape\Windows Balloon.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Raga\Windows Hardware Remove.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Characters\Windows Pop-up Blocked.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Delta\Windows Hardware Insert.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Garden\Windows Logoff Sound.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Heritage\Windows Print complete.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-epgtos.resources_31bf3856ad364e35_6.1.7600.16385_en-us_29b70e81faa66c43\epgtos.txt 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Afternoon\Windows Error.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Garden\Windows Balloon.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Landscape\Windows Feed Discovered.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Windows Ringout.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Heritage\Windows Ding.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\ir_end.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\Gadget_Waitcursor.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Web\Wallpaper\Architecture\img18.jpg 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Festival\Windows Exclamation.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Quirky\Windows Ding.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Raga\Windows Print complete.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Performance\WinSAT\Clip_1080_5sec_10mbps_h264.mp4 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Performance\WinSAT\Clip_480p_5sec_6mbps_new.mpg 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\settings.html 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp5.jpg 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Characters\Windows Notify.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Delta\Windows Battery Low.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Savanna\Windows User Account Control.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\Gadget_Main_Background_Loading.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp4.jpg 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Calligraphy\Windows Battery Critical.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Quirky\Windows Hardware Insert.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\recycle.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Landscape\Windows Print complete.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Web\Wallpaper\Landscapes\img8.jpg 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_6.1.7601.17514_none_a54b31331066c8e2\watermark.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\logo.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_1x1.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\button_play.png 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Characters\Windows Logon Sound.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Sonata\Windows Navigation Start.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Windows Exclamation.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Afternoon\Windows Battery Critical.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Landscape\Windows Battery Low.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Media\Raga\Windows Feed Discovered.wav 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Modifies registry class 10 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fullcrypted 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.fullcrypted\ = "BYWWLWTPWPUCPSO" 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO\ = "CRYPTED!" 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\34EeU833qyc18xe.exe,0" 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO\shell\open\command 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO\shell 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\34EeU833qyc18xe.exe" 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO\DefaultIcon 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BYWWLWTPWPUCPSO\shell\open 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exedescription pid process target process PID 656 wrote to memory of 572 656 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe PID 656 wrote to memory of 572 656 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe PID 656 wrote to memory of 572 656 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe PID 656 wrote to memory of 572 656 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe PID 656 wrote to memory of 572 656 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe PID 656 wrote to memory of 572 656 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe PID 656 wrote to memory of 572 656 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe PID 656 wrote to memory of 572 656 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe 48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe"C:\Users\Admin\AppData\Local\Temp\48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exeC:\Users\Admin\AppData\Local\Temp\48ed28cfb53a72e291f67a4f4cd11b9a7bcff5301359ade0c543be72b536ed7d.exe2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:572