Analysis
-
max time kernel
107s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2022 23:26
Behavioral task
behavioral1
Sample
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe
Resource
win10v2004-20220901-en
General
-
Target
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe
-
Size
7KB
-
MD5
cfbc736d5a16198f13e7bf360e5004be
-
SHA1
4aea5ace463590c5c2bd1cc571851e5e630d9331
-
SHA256
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c
-
SHA512
59a51ab1bcc070ae20e385e56ba2d0afe9e4ee6088cfe06e1de9c0d33cb4afe6ca55a92f6d137209b0cbf4a19eb2601ea4085e40e0a5d1e224e1993350d604ab
-
SSDEEP
192:Gzdrr1FG1WDCgmjPZPx2ds9ct1X0utLRMUA:Gprr1gkDCgSCd6ct+gFMB
Malware Config
Signatures
-
Detected Xorist Ransomware 3 IoCs
Processes:
resource yara_rule behavioral2/memory/400-132-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/400-133-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/400-134-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 3 IoCs
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process File renamed C:\Users\Admin\Pictures\FindClear.png => C:\Users\Admin\Pictures\FindClear.png.hfi 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe -
Processes:
resource yara_rule behavioral2/memory/400-132-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/400-133-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/400-134-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0OBBDSsH5F8mq7J.exe" 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe -
Drops file in System32 directory 64 IoCs
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\netbvbda.inf_amd64_06bc8afcd2617abf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\sensorshidclassdriver.inf_amd64_b5ae080ff669eab3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\usbcciddriver.inf_amd64_400a61104320a399\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0024\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\nl-NL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis1u.inf_amd64_64035dd8a7571ba7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmc288.inf_amd64_3e3f05a8a446e75f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_9a5b429abc465278\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0003\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_9c09bd1df352f065\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcom1.inf_amd64_cfd501781ae941c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\ucmucsiacpiclient.inf_amd64_a233292790c69f03\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\c_cashdrawer.inf_amd64_a648ee708660440c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnokia.inf_amd64_9be5ff0f15b15eb7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\sk-SK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\amdgpio2.inf_amd64_808fe94735c4c6b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\et-EE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnttme.inf_amd64_edc94fc65bef3d27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\remoteposdrv.inf_amd64_0f0da968c1cfce06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fdc.inf_amd64_fe3599e7eac09e7f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\cdrom.inf_amd64_28c103304ddff3c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmbw561.inf_amd64_0406b31e81bea0d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SysWOW64\@AudioToastIcon.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmagm64.inf_amd64_7f60bc7ff484a292\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\wnetvsc_vfpp.inf_amd64_9ce6f68c11eede58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fsundelete.inf_amd64_741f159cc6ce7814\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\wdma_usb.inf_amd64_e879d41db6fd1ab8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\c_ports.inf_amd64_181d494584779290\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_a7412a554c9bc1fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\wave.inf_amd64_8e8496aa33c0a7f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\lltdio.inf_amd64_4faf5a37ebdbec2b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DeliveryOptimization\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetLbfo\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\c_bluetooth.inf_amd64_7e49a68f06c14d10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\monitor.inf_amd64_8a98af5011ee4dc6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl005.inf_amd64_d9886a7bbe9e55ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\uicciso.inf_amd64_32023cb966fd5c8c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmlasat.inf_amd64_36a71a022d8bb0bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_557ce3b37c3e0e3b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\wpdfs.inf_amd64_1183fd0f13045f2e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisuio.inf_amd64_6096fd74a67ccd5d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SysWOW64\Licenses\neutral\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgsm.inf_amd64_d7b1959484ec8228\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe -
Drops file in Program Files directory 64 IoCs
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-30_altform-unplated_contrast-white.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-150.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-125.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-60_contrast-black.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-lightunplated.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxBadge.scale-150.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\CompleteCheckmark.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchWideTile.contrast-white_scale-100.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-80.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\SmallTile.scale-100.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-24_altform-unplated.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\196.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-16_altform-unplated.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-96_altform-lightunplated.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\media_poster.jpg 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-100_contrast-black.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close_h.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-16_contrast-white.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteWideTile.scale-400.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupMedTile.scale-150.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-100.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailSmallTile.scale-100.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\WideTile.scale-200.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\LargeTile.scale-200.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageBadgeLogo.scale-125_contrast-white.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\WideTile.scale-200.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-200_contrast-white.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-black_scale-125.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\LargeTile.scale-125.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-64_altform-unplated.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxMediumTile.scale-100.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLargeTile.scale-200.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\PREVIEW.GIF 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fi-fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-96_altform-lightunplated.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteWideTile.scale-150.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\organize_poster.jpg 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\AppExcel32x32.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\complete.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\Internet Explorer\SIGNUP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\24.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-200_contrast-white.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-400.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\SmallTile.scale-200.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-60.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-200_contrast-black.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe -
Drops file in Windows directory 64 IoCs
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-onecore-r..ping-resourcemapper_31bf3856ad364e35_10.0.19041.789_none_04b460cebddd158e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_eddf8132c42e0857\SmallLogo.scale-100.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_windows-media-speech-winrt.resources_31bf3856ad364e35_10.0.19041.789_en-us_41e360b7f39034a8\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-verifier_31bf3856ad364e35_10.0.19041.1_none_8a4aed389c6bb32e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_Code\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\pris\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-bluetooth-userapis_31bf3856ad364e35_10.0.19041.1_none_21a631c05f72db9c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spfileq_31bf3856ad364e35_10.0.19041.1081_none_e9c4bc0774dd1b98\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ctshow-dv.resources_31bf3856ad364e35_10.0.19041.1_en-us_d88b5ef9847759ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wsp-spaces.resources_31bf3856ad364e35_10.0.19041.1_en-us_5b12af52f11b93cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Assets\SplashScreen.scale-100.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..oldertool.resources_31bf3856ad364e35_10.0.19041.1_en-us_c94163e939bb3e6e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleLogo.targetsize-32_altform-unplated_contrast-white.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_dual_mdmmetri.inf_31bf3856ad364e35_10.0.19041.1_none_3120d8284b6c381a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cementmanifests-com_31bf3856ad364e35_10.0.19041.746_none_95ea7ee381d003dc\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagestateroaming_31bf3856ad364e35_10.0.19041.746_none_f54f3e2f30856475\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P9de5a786#\7b5c5e18f54175c9d821602aea803caa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_hyperv-vp9fs_31bf3856ad364e35_10.0.19041.153_none_dc5d06f37302e699\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft.hostcompute.interop_31bf3856ad364e35_10.0.19041.1_none_b3a44c6d7e3f53a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobecortana-main.html 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.19041.964_none_e2d83fe00c5aca7d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tssessionux-library_31bf3856ad364e35_10.0.19041.746_none_58a2a6ef1d633015\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\wow64_windows-application..-appcontracts-winrt_31bf3856ad364e35_10.0.19041.1081_none_0a512a946737140b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\Exchange.Theme-Light_Scale-400.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-backup-cpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_8430289ca2303020\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-brokerbase_31bf3856ad364e35_10.0.19041.1151_none_f848b9fd20d14a96\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasifmon.resources_31bf3856ad364e35_10.0.19041.1_en-us_648c89538ca0acc7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..platform-input-wisp_31bf3856ad364e35_10.0.19041.746_none_b96d68196ffb85a6\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_9478227a478f23d5\about_TestDrive.help.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-memoryanalyzer_31bf3856ad364e35_11.0.19041.746_none_8889db5dc377e286\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\diagnostics\system\Device\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..d-keyboardfilterwmi_31bf3856ad364e35_10.0.19041.844_none_3a60e0c3d7e5e251\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.targetsize-64.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\AnswerWithVideo.scale-300.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\square150x150logo.scale-100_contrast-white.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_dual_wvmic_guestinterface.inf_31bf3856ad364e35_10.0.19041.1_none_a3750aa62b1952d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..dlinetool.resources_31bf3856ad364e35_10.0.19041.1_en-us_38200a3bee0c73a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\wow64_windows-storage-applicationdata-winrt_31bf3856ad364e35_10.0.19041.746_none_ccbed6de69b40136\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-40_contrast-black.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.844_none_de5d9fe254d9f8c4\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.19041.1_none_9d2d2a9ab0964bc3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_10.0.19041.1_none_a03b7086d9468b36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\PPIRemovableStorageDevicesSquareTile44x44.scale-200.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-nameinput_31bf3856ad364e35_10.0.19041.1_none_13a3f68414e868c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Square150x150Logo.contrast-black_scale-200.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\WiFiNetworkManagerWarningToast.scale-100_contrast-white.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.1_none_90e29eafea574969\Steps Recorder.lnk 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_system.servicemodel.routing_31bf3856ad364e35_4.0.15805.0_none_e9fa01729e2e6fac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\Manifests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ience-common-logger_31bf3856ad364e35_10.0.19041.1_none_2db50111a1399624\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.746_none_3ed4d566b640ef5b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..vider-rll.resources_31bf3856ad364e35_10.0.19041.1_en-us_d8c9a2608b4c4359\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_hyperv-vmpmem_31bf3856ad364e35_10.0.19041.928_none_c0e2380df2a05bc7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_f12_context_chartselection_clear.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-undockeddevkit_31bf3856ad364e35_10.0.19041.153_none_3063e84316f81cdd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare44x44.targetsize-36_altform-unplated.png 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine-plugins_31bf3856ad364e35_10.0.19041.1266_none_43fc06cabc62ece5\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_10.0.19041.1_none_f61d759c251ca03d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001041b_31bf3856ad364e35_10.0.19041.1_none_560c3edde82e54b6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ftaccount-extension_31bf3856ad364e35_10.0.19041.746_none_daefcf4d749952c4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..terface-ldapc-layer_31bf3856ad364e35_10.0.19041.1_none_152381bd05dadff7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..ux-wlanmediamanager_31bf3856ad364e35_10.0.19041.1_none_2739672f84afaa32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe -
Modifies registry class 10 IoCs
Processes:
397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\shell 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hfi 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\ = "CRYPTED!" 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0OBBDSsH5F8mq7J.exe,0" 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0OBBDSsH5F8mq7J.exe" 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hfi\ = "IOQPRVJIYYXVXAQ" 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\DefaultIcon 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\shell\open\command 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\shell\open 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe"C:\Users\Admin\AppData\Local\Temp\397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:400