Analysis
-
max time kernel
151s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 21:11
Behavioral task
behavioral1
Sample
c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe
Resource
win10v2004-20220812-en
General
-
Target
c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe
-
Size
1.4MB
-
MD5
8901e13e8e01a6f9223c78a903d8fb46
-
SHA1
a015f096d431e42e0df67b21c4eabe4ebf2f476a
-
SHA256
c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4
-
SHA512
f7ae948f33fb2270c5ea5bd150c039592edb8d1511dce1077739f17b4f91c6b43c9075a71f15248f7f94f0c159be3e5dcd189c93b7bcbc99847a8185f374ff08
-
SSDEEP
24576:q9WQitvyUilzOUxaOWk01G4fbu/F41jen6KXYzkEEknJS7DFN4L3GmPA705sCvsF:q9WDAUozOUxaOyGau6I6WPDvlAAoefk1
Malware Config
Signatures
-
Detected Xorist Ransomware 2 IoCs
Processes:
resource yara_rule behavioral1/memory/784-55-0x0000000000400000-0x0000000000560000-memory.dmp family_xorist behavioral1/memory/784-56-0x0000000000400000-0x0000000000560000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 8 IoCs
Processes:
c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exedescription ioc process File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\w8i9eHkHOwWwQlX.exe" c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe -
Drops file in System32 directory 64 IoCs
Processes:
c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\cxfalcon_ibv64.inf_amd64_neutral_d065aec3fcf4ec4e\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky004.inf_amd64_neutral_5db759db19acd3ae\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\wd.inf_amd64_neutral_759109899b486d47\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Session_Configurations.help.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\hpsamd.inf_amd64_neutral_84ae149ecc9f8033\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\wiabr008.inf_amd64_neutral_27d1c9a28eac4eed\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\EnterpriseE\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0003\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_data_sections.help.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_WS-Management_Cmdlets.help.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_If.help.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\prnsv002.inf_amd64_neutral_6ca80563d6148ee5\Amd64\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\EnterpriseE\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001f\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Ultimate\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IasServer-MigPlugin\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\slmgr\0C0A\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ja-JP\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\System32\catroot2\dberr.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa5.inf_amd64_neutral_ea8128ac5da37eb9\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\fr-FR\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_command_precedence.help.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_output.help.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00a.inf_amd64_neutral_d64d696193e69d7b\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Quoting_Rules.help.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_type_operators.help.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Assignment_Operators.help.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomePremiumE\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc004.inf_amd64_neutral_bbd3435eeaf576ee\Amd64\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremium\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\System.gif c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\Amd64\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomePremiumN\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\Professional\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep002.inf_amd64_neutral_efc4a7485b172c07\Amd64\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00b.inf_amd64_neutral_89b555703683b583\Amd64\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Core_Commands.help.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmags64.inf_amd64_neutral_e68956e24e287714\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj3.inf_amd64_neutral_7e1053ab483310f6\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\fr-FR\erofflps.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_types.ps1xml.help.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_For.help.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_hash_tables.help.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\XPSViewer\fr-FR\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx008.inf_amd64_neutral_75545721835fd863\Amd64\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\migwiz\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\acpi.inf_amd64_neutral_aed2e7a487803437\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpin.inf_amd64_neutral_2415474b9db0a888\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_neutral_68988e550e69a417\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\StarterN\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwat.inf_amd64_neutral_213e93b5ced8b0fe\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\fr-FR\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\mdminfot.inf_amd64_neutral_fc6bcd80e9e6a3c3\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaxx002.inf_amd64_neutral_fbe080a7dd77c4a3\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00b.inf_amd64_neutral_2e6b718b2b177506\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_prompts.help.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdp2.inf_amd64_neutral_ab710894455d7b9a\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmisdn.inf_amd64_neutral_061c61abd3904560\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\System32\DriverStore\FileRepository\wdmvsc.inf_amd64_neutral_a2cf745000e2ea92\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe -
Drops file in Program Files directory 64 IoCs
Processes:
c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exedescription ioc process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_hail.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14830_.GIF c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\TextFile.zip c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_dot.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\icon.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\Internet Explorer\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\Windows Media Player\it-IT\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_orange.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382931.JPG c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143744.GIF c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_bkg.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_rest.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21519_.GIF c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\CALENDAR.GIF c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\Microsoft Games\Mahjong\en-US\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR4B.GIF c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_m.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_sun.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_s.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\Common Files\System\es-ES\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14529_.GIF c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_bezel.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\search_background.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-middle.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\Windows Mail\de-DE\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\PREVIEW.GIF c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR43B.GIF c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_flyout.png c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0177257.JPG c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\THMBNAIL.PNG c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01046J.JPG c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe -
Drops file in Windows directory 64 IoCs
Processes:
c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exedescription ioc process File opened for modification C:\Windows\Media\Quirky\Windows Pop-up Blocked.wav c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallSqlState.sql c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_mdmnttp2.inf_31bf3856ad364e35_6.1.7600.16385_none_30292759e684c77e\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..g-base-professional_31bf3856ad364e35_6.1.7600.16385_none_5033cc0ab905012a\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bootconfig.resources_31bf3856ad364e35_6.1.7600.16385_es-es_20a4a7ffdd575f27\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\it\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_disk.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_626b9448fd63c9a1\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_hal.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_997f9822c7490adb\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_mdmmts.inf_31bf3856ad364e35_6.1.7600.16385_none_bee826439264ce7c\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_mdmvv.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_464a03410f3981f7\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..e-results.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4a47802690327476\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-crypt32-dll.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_58ec176c913d7aa6\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..g-cmdline.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b1f3571064438086\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.Abstractions.resources\3.5.0.0_de_31bf3856ad364e35\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.IdentityModel\0a637affd530a4ee90f0ed36c3febc79\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_mdmbr008.inf_31bf3856ad364e35_6.1.7600.16385_none_c32ad6c89eb402fe\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..ruetype-segoescript_31bf3856ad364e35_6.1.7601.17514_none_32eade0d03ae2a68\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_dot4prt.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e4de75d2183603a9\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_iirsp.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a258cf424b77be5b\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-efs-service.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d7a848d023c8969c\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\inf\ASP.NET_4.0.30319\0019\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-com-complus.res_31bf3856ad364e35_6.1.7600.16385_none_88a5cc7effe2dfca\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-commonlog.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6e4dacd214324325\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.VisualC\74de34cd518bf49352c8346149ddfbc1\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.AddI3d71a354#\e9b555ea0ea297aaf786f05eefd6e5a9\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\inf\ASP.NET\0816\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..mecontrol.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_67fd31de7795e748\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eventviewer.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0d45c6504da51061\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ctshow-dv.resources_31bf3856ad364e35_6.1.7600.16385_en-us_743a98caca6a17eb\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..w-capture.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d36fce677b431996\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d2d_31bf3856ad364e35_6.1.7601.17514_none_05c2ec3372908373\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\Media\Festival\Windows Ding.wav c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-anytime-upgrade_31bf3856ad364e35_6.1.7600.16385_none_fb591b6cf023ade3\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-console.resources_31bf3856ad364e35_6.1.7600.16385_it-it_66c13d41262bb2b4\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\9469491f37d9c35b596968b206615309\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_battery.inf.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_f1e80a5c0dda0243\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_megasr.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c1ae6009ec8c7566\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\inf\.NET CLR Networking 4.0.0.0\0416\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_mdmhayes.inf_31bf3856ad364e35_6.1.7600.16385_none_4afb2ef6408c5ee8\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_megasas.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6a9f7adfa0d9a71a\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bootconfig.resources_31bf3856ad364e35_6.1.7600.16385_en-us_20d94b1bdd306d82\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..helibrary.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8ca0350f2122a9d3\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_a3dab79bf7c211cf\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dui70_31bf3856ad364e35_6.1.7600.16385_none_b3a9a17817cbcd9e\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\3.5.0.0__b77a5c561934e089\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fde.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8cff405e05768c66\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_mdmbtmdm.inf_31bf3856ad364e35_6.1.7600.16385_none_4998bfc1a50ffd5a\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-commonlog.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_10d07fb5072b4b2c\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..trics-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_11b1a08795dae83f\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directwrite.resources_31bf3856ad364e35_7.1.7601.16492_hu-hu_cab3b172475e654c\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehkorime_31bf3856ad364e35_6.1.7600.16385_none_4ad84a579cb593ce\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..lications.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c75de581a6dbdfaa\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_5cbb962a4f0d58c1\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\Media\Sonata\Windows Information Bar.wav c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_mdmhayes.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_02979a084b1788b5\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..assistant.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcd3cafd91383411\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..fessional.resources_31bf3856ad364e35_6.1.7601.17514_en-us_090436357cf6c2b9\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-display.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f76d5676e7d5a264\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData\v4.0_4.0.0.0__31bf3856ad364e35\HOW TO DECRYPT FILES.txt c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\ja\SqlPersistenceService_Logic.sql c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe -
Modifies registry class 10 IoCs
Processes:
c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\ = "CRYPTED!" c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\DefaultIcon c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\w8i9eHkHOwWwQlX.exe,0" c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\shell\open\command c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\shell\open c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\w8i9eHkHOwWwQlX.exe" c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoTorLocker2015! c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoTorLocker2015!\ = "PRPASCBHJSZLMOM" c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\shell c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exepid process 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exepid process 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exedescription pid process Token: SeDebugPrivilege 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe Token: SeTakeOwnershipPrivilege 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe Token: SeRestorePrivilege 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe Token: SeBackupPrivilege 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe Token: SeChangeNotifyPrivilege 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exedescription pid process target process PID 784 wrote to memory of 368 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe wininit.exe PID 784 wrote to memory of 368 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe wininit.exe PID 784 wrote to memory of 368 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe wininit.exe PID 784 wrote to memory of 368 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe wininit.exe PID 784 wrote to memory of 368 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe wininit.exe PID 784 wrote to memory of 368 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe wininit.exe PID 784 wrote to memory of 368 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe wininit.exe PID 784 wrote to memory of 376 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe csrss.exe PID 784 wrote to memory of 376 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe csrss.exe PID 784 wrote to memory of 376 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe csrss.exe PID 784 wrote to memory of 376 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe csrss.exe PID 784 wrote to memory of 376 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe csrss.exe PID 784 wrote to memory of 376 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe csrss.exe PID 784 wrote to memory of 376 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe csrss.exe PID 784 wrote to memory of 416 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe winlogon.exe PID 784 wrote to memory of 416 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe winlogon.exe PID 784 wrote to memory of 416 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe winlogon.exe PID 784 wrote to memory of 416 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe winlogon.exe PID 784 wrote to memory of 416 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe winlogon.exe PID 784 wrote to memory of 416 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe winlogon.exe PID 784 wrote to memory of 416 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe winlogon.exe PID 784 wrote to memory of 460 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe services.exe PID 784 wrote to memory of 460 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe services.exe PID 784 wrote to memory of 460 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe services.exe PID 784 wrote to memory of 460 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe services.exe PID 784 wrote to memory of 460 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe services.exe PID 784 wrote to memory of 460 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe services.exe PID 784 wrote to memory of 460 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe services.exe PID 784 wrote to memory of 476 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe lsass.exe PID 784 wrote to memory of 476 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe lsass.exe PID 784 wrote to memory of 476 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe lsass.exe PID 784 wrote to memory of 476 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe lsass.exe PID 784 wrote to memory of 476 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe lsass.exe PID 784 wrote to memory of 476 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe lsass.exe PID 784 wrote to memory of 476 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe lsass.exe PID 784 wrote to memory of 484 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe lsm.exe PID 784 wrote to memory of 484 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe lsm.exe PID 784 wrote to memory of 484 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe lsm.exe PID 784 wrote to memory of 484 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe lsm.exe PID 784 wrote to memory of 484 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe lsm.exe PID 784 wrote to memory of 484 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe lsm.exe PID 784 wrote to memory of 484 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe lsm.exe PID 784 wrote to memory of 584 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 584 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 584 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 584 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 584 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 584 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 584 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 664 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 664 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 664 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 664 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 664 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 664 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 664 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 748 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 748 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 748 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 748 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 748 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 748 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 748 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe PID 784 wrote to memory of 796 784 c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:476
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:460
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:748
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:796
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵PID:1312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:864
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:296
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1232
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:600
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:324
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:1008
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:836
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:584
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:376
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:484
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe"C:\Users\Admin\AppData\Local\Temp\c1ff7936d3eb96ab174c4411bfb95ae7ba287e0a9abb8cd26002610b62318de4.exe"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784