Analysis
-
max time kernel
105s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
21-11-2022 23:26
Behavioral task
behavioral1
Sample
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe
Resource
win10v2004-20220901-en
General
-
Target
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe
-
Size
7KB
-
MD5
cfbc736d5a16198f13e7bf360e5004be
-
SHA1
4aea5ace463590c5c2bd1cc571851e5e630d9331
-
SHA256
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c
-
SHA512
59a51ab1bcc070ae20e385e56ba2d0afe9e4ee6088cfe06e1de9c0d33cb4afe6ca55a92f6d137209b0cbf4a19eb2601ea4085e40e0a5d1e224e1993350d604ab
-
SSDEEP
192:Gzdrr1FG1WDCgmjPZPx2ds9ct1X0utLRMUA:Gprr1gkDCgSCd6ct+gFMB
Malware Config
Signatures
-
Detected Xorist Ransomware 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1048-55-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral1/memory/1048-56-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral1/memory/1048-57-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 8 IoCs
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe -
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process File renamed C:\Users\Admin\Pictures\InvokeExit.png => C:\Users\Admin\Pictures\InvokeExit.png.hfi 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File renamed C:\Users\Admin\Pictures\ResumeConvertFrom.png => C:\Users\Admin\Pictures\ResumeConvertFrom.png.hfi 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File renamed C:\Users\Admin\Pictures\ShowWait.png => C:\Users\Admin\Pictures\ShowWait.png.hfi 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File renamed C:\Users\Admin\Pictures\SplitClear.png => C:\Users\Admin\Pictures\SplitClear.png.hfi 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File renamed C:\Users\Admin\Pictures\UseAdd.png => C:\Users\Admin\Pictures\UseAdd.png.hfi 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe -
Processes:
resource yara_rule behavioral1/memory/1048-55-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1048-56-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1048-57-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0OBBDSsH5F8mq7J.exe" 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe -
Drops file in System32 directory 64 IoCs
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process File created C:\Windows\SysWOW64\IME\imekr8\applets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_If.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\arcsas.inf_amd64_neutral_c763887719bed95d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\fdc.inf_amd64_neutral_bbcfca39fdc02275\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Automatic_Variables.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\winrm\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00f.inf_amd64_neutral_a5f6001b957bd7e0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\v_mscdsc.inf_amd64_neutral_8b1e6b55729c3283\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_execution_policies.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mpio.inf_amd64_neutral_0c74c0f95001b61c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\ts_wpdmtp.inf_amd64_neutral_daa64ca27846aa23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_operators.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Signing.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc002.inf_amd64_neutral_fdb6f2e252435905\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\ehstorcertdrv.inf_amd64_neutral_2e1cecffae9c899a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmarn.inf_amd64_neutral_fa693d8797766f49\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmbsb.inf_amd64_neutral_56a9f6bceeec7f72\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmlasno.inf_amd64_neutral_c86d5b5e5fa8b48a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmzyp.inf_amd64_neutral_b64bd08009e7444f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky308.inf_amd64_ja-jp_d90af802b607044a\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaca00a.inf_amd64_neutral_163313056d8f34ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmhrtz.inf_amd64_neutral_10affee00545fb45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis3t.inf_amd64_neutral_857ff0fa9c73850a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgcs.inf_amd64_neutral_aafcd45e4e890862\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_neutral_7a5f47d3150cc0eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\IME\IMESC5\applets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_parameters.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\arc.inf_amd64_neutral_11b52dec8e94d9aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdp2.inf_amd64_neutral_ab710894455d7b9a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_environment_variables.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SysWOW64\ja-JP\erofflps.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\prngt004.inf_amd64_neutral_f5bf8a7ba9dfff55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\cxraptor_philipstuv1236d_ibv64.inf_amd64_neutral_b6a3e57df5bad299\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdgitn.inf_amd64_neutral_09132735f1063a47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\cxraptor_fm1236mk5_ibv64.inf_amd64_neutral_b81bec917adfaea5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc00a.inf_amd64_neutral_565c5d04cc520c48\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_output.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtx64.inf_amd64_neutral_410e89ed86071c9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\icsxml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcxhv6.inf_amd64_neutral_81ba64c5b6150dd3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsun1.inf_amd64_neutral_6184912bd8e5b438\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\nettun.inf_amd64_neutral_bd24fb174fabec97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0010\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe -
Drops file in Program Files directory 64 IoCs
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\25.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files\Windows Defender\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\PREVIEW.GIF 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8B.GIF 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\flyout.html 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_windy.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01740_.GIF 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_m.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)greenStateIcon.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\WHOOSH.WAV 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309567.JPG 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10265_.GIF 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\METCONV.TXT 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\THMBNAIL.PNG 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files\Common Files\System\Ole DB\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Common Files\System\ado\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382963.JPG 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Windows Defender\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_Off.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_down.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_SlateBlue.gif 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_Undocked.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382926.JPG 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImages.jpg 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_windy.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115866.GIF 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_h.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099148.JPG 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145879.JPG 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\SUCTION.WAV 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe -
Drops file in Windows directory 64 IoCs
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process File created C:\Windows\winsxs\amd64_microsoft-windows-help-games.resources_31bf3856ad364e35_6.1.7600.16385_it-it_bf01c3a55c49c362\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-powershell_31bf3856ad364e35_6.1.7601.17514_none_5b56b853bd5adf50\Windows PowerShell Modules.lnk 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-lddmcore.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_997d118522b47f35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1da2af67#\7a885358d88fb60782e41c3a3af3c255\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\inf\aspnet_state\0013\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bca30fa029c53981\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..sh-helper.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9b3b900d1741a8cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..es-spades.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b3b89151ccf0eda5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_subsystem-for-unix-..lications.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d7122687f7e7f4b0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_methods.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_mdmcxpv6.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_72f3d4cf9d3dccb6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7601.17514_de-de_f1c4ddbe1d6460ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ado15-rll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_e95cc2fdb50fc22f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\x86_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1e171ce0b8b501a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.FormControl\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\403-7.htm 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-virtualpc-usb-rpm_31bf3856ad364e35_6.1.7601.17514_none_955e10988c5454aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-00010419_31bf3856ad364e35_6.1.7600.16385_none_f43626f5a292dd3e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\assembly\GAC_MSIL\System.WorkflowServices.resources\3.5.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-shdocvw.resources_31bf3856ad364e35_6.1.7600.16385_en-us_23b7b32e73eca54a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-synchost_31bf3856ad364e35_6.1.7600.16385_none_c575fec016436d8a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-windowsconnectnow-adm_31bf3856ad364e35_6.1.7600.16385_none_8fd43e96f3452405\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_netfx35linq-addinprocess_31bf3856ad364e35_6.1.7601.17514_none_8ebd3037635a8b2f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_amdsata.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f331045b76819f78\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..onal-codepage-28605_31bf3856ad364e35_6.1.7600.16385_none_ad6a3903005fbe4c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_objects.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.17932_none_148d033db306b9bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_server-help-chm.reliab.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1eb6d304a88f909e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..ptdebugui.resources_31bf3856ad364e35_8.0.7600.16385_de-de_638980a483bcb52b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\x86_microsoft-windows-netsh.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b8447efcf8afb145\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_WS-Management_Cmdlets.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..almanager.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_82af05b7c6f3e6a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..onal-codepage-20269_31bf3856ad364e35_6.1.7600.16385_none_afe07d36fed117fe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..ndthemes-characters_31bf3856ad364e35_6.1.7600.16385_none_08da32b0fdad9220\Windows Exclamation.wav 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_netnvma.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5cd47ea41c470020\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\wow64_microsoft-windows-winsrv.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a3de389e52a4b2f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\x86_microsoft-windows-xpsifilter.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9dcdcf8276ce0da5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_099d2ebabfe3f476\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft.windows.c..ration.online.setup_31bf3856ad364e35_6.1.7600.16385_none_0dbedb7c5ac04a7d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\msil_system.xml.resources_b77a5c561934e089_6.1.7600.16385_de-de_1ef168b2be09072a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..age-codec.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_51d96e90838bcdda\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\x86_microsoft-windows-raschap.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d112b2806a4f19b1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\x86_microsoft-windows-t..pulations.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b6d6b255e38b4c57\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Compba577418#\ea53e69de4ca155788883a9c2d18f31a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8cded1d3e03abbe0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..ywmdmcesp.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ccdf88142b1c0801\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\wow64_microsoft-windows-ntshrui_31bf3856ad364e35_6.1.7601.17514_none_c48a5e32475f1149\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_functions_cmdletbindingattribute.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_scripts.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_Signing.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\x86_microsoft-windows-n..5linqcomp.resources_31bf3856ad364e35_6.1.7601.17514_it-it_46e7f1f4bdaedd67\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_es-es_d9a2e129b5039123\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img16.jpg 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..shell-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fe68f514b890400e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..geadapter.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e139c7ad960d9120\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..orkclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b96369a01803be04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-irmon.resources_31bf3856ad364e35_6.1.7600.16385_es-es_963998dee0e21f76\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\x86_microsoft-windows-isoburn.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ff94c8bb53d5e686\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\msil_microsoft.powershel..nsolehost.resources_31bf3856ad364e35_6.1.7600.16385_it-it_e84d205c49812ab9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ment-core.resources_31bf3856ad364e35_6.1.7600.16385_en-us_11c8098e228f7a96\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\winsxs\amd64_wpdmtp.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f515215260449c0b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe -
Modifies registry class 10 IoCs
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\shell\open\command 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hfi 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hfi\ = "IOQPRVJIYYXVXAQ" 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\ = "CRYPTED!" 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\DefaultIcon 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0OBBDSsH5F8mq7J.exe" 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0OBBDSsH5F8mq7J.exe,0" 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\shell 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\shell\open 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe"C:\Users\Admin\AppData\Local\Temp\397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1048