Analysis
-
max time kernel
100s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-01-2023 21:02
Behavioral task
behavioral1
Sample
841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe
-
Size
7KB
-
MD5
a29fc50d11f97997ce0c38ecd238355e
-
SHA1
52e21efa1477c1bd269eddd91ae0a13d3e47e835
-
SHA256
841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83
-
SHA512
a10afe7db8b8773f3fb8d728abb0b748a6dd6b41ef045f66eda00eaf09ea9603147c5477c3a56bf65add3716001a493880db50e93522d305e61db198284fde55
-
SSDEEP
192:nzdrr1FG1WDCgmjPZEysGsXpFHL99oMUA:nprr1gkDCgS+dGWpFHL9KMB
Score
10/10
Malware Config
Signatures
-
Detected Xorist Ransomware 3 IoCs
resource yara_rule behavioral1/memory/1488-55-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral1/memory/1488-56-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral1/memory/1488-57-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SkipOpen.png => C:\Users\Admin\Pictures\SkipOpen.png.tg 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File renamed C:\Users\Admin\Pictures\RemoveReceive.png => C:\Users\Admin\Pictures\RemoveReceive.png.tg 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe -
resource yara_rule behavioral1/memory/1488-55-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1488-56-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1488-57-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5vPl3Y4523Ek90l.exe" 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\mdmnttd2.inf_amd64_neutral_9dcd97ab7a913b7a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\hr-HR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\BITSExtensions-Server\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\amdsbs.inf_amd64_neutral_5cae6933bef20aa8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfport.inf_amd64_neutral_f41f35e5c21bc350\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_neutral_4616c3de1949be6d\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\windowssideshowenhanceddriver.inf_amd64_neutral_184a2ef2a8f57c33\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Variables.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmot64.inf_amd64_neutral_1abbad2f29c8fa08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\spp\tokens\pkeyconfig\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_scopes.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmjf56e.inf_amd64_neutral_328dabbf0aeed9bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_properties.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\af9035bda.inf_amd64_neutral_aa11aa34552d1d4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmarch.inf_amd64_neutral_4261401e3170ebfb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mpio.inf_amd64_neutral_0c74c0f95001b61c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Break.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\XPSViewer\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_locations.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmneuhs.inf_amd64_neutral_d1563e8412461eea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_neutral_d834e48846616289\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_eventlogs.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\acpi.inf_amd64_neutral_aed2e7a487803437\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc3.inf_amd64_neutral_1da6abc36a79974f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_environment_variables.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions_advanced.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmcd.inf_amd64_neutral_49212f5920298e45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmrock3.inf_amd64_neutral_9fdc5d710dd63e80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\en-US\Licenses\eval\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_troubleshooting.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep002.inf_amd64_neutral_efc4a7485b172c07\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00e.inf_amd64_neutral_0a4797d9b127d3a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_neutral_d834e48846616289\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\ql2300.inf_amd64_neutral_ca8487daf77ff7cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\tsusbhubfilter.inf_amd64_neutral_d0615d6fd67bad03\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Core_Commands.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IIS-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_split.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_methods.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\en-US\Licenses\eval\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\IME\IMESC5\applets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Core_Commands.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00b.inf_amd64_neutral_89b555703683b583\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Command_Syntax.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_environment_variables.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\avmx64c.inf_amd64_neutral_8ebb15bf548db022\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\Common Files\System\ado\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.htm 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02738U.BMP 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Windows Mail\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Windows Sidebar\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_cloudy.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01838_.GIF 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15169_.GIF 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\settings.html 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02187_.GIF 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_snow.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.jpg 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\Windows NT\Accessories\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21315_.GIF 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21527_.GIF 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR2B.GIF 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter_partly-cloudy.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\calendar.html 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\THMBNAIL.PNG 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\THMBNAIL.PNG 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01247U.BMP 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Country.gif 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_disabled.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\activity16v.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\README.HTM 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24Images.jpg 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24ImagesMask.bmp 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_bottom.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21312_.GIF 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313896.JPG 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl-hot.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01239_.GIF 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14795_.GIF 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_settings.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-vertical.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\weather.html 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR33F.GIF 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\Microsoft Games\Chess\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-g..policy-admin-appmgr_31bf3856ad364e35_6.1.7601.17514_none_58df6170cc98ffe6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-currency_31bf3856ad364e35_6.1.7600.16385_none_c3b9072b536514f6\graph_down.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..rvice_mof.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2507f83c52d906be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.XDocument\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c99bfc6ddd1bf1d2\slideShow.html 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-devtools_31bf3856ad364e35_8.0.7601.17514_none_b4855976cd77e0e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\msil_microsoft.powershel..hicalhost.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9f20a6abfea7ad81\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\msil_msbuild.resources_b03f5f7f11d50a3a_6.1.7600.16385_es-es_2bfdb524804a1802\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_Special_Characters.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..trics-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_dc160164dcd1eef5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..sh-helper.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_72fcae3cc365b3f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ntshrui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_540fd2e32d90e044\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..topeerdrt.resources_31bf3856ad364e35_6.1.7600.16385_en-us_81e493435b53e369\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmiperf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_216a5d62a6c7047b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_prnge001.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f7032ee8652ba164\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_wceisvista.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2530ff21af35f933\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_wialx005.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_13d08387d895ed42\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..services-sam-netapi_31bf3856ad364e35_6.1.7601.17514_none_88c9aa75246d2ded\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..helibrary.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2ec5b41c143dbbae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_gray_snow.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..onservice.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9d774b2480379bab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..panel-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_dd63019c9efb6c77\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_netfx-system_b03f5f7f11d50a3a_6.1.7601.17514_none_bf2f9d3ffdcfb10a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-nshhttp.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_01cc6dc48bd9c820\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..g-jscript.resources_31bf3856ad364e35_8.0.7600.16385_en-us_6e8728b65ebff004\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..w-capture.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5f322e305c2f9083\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-harddev.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4cd4fb162885e75b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_wiabr004.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a6ebad258c07aca8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-photoviewer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1f351a21979e0848\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..try-agent.resources_31bf3856ad364e35_6.1.7600.16385_it-it_500849b2fffbbf4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..e-ehsched.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aaf0a6f1a2522646\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-kernelceip.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3a93155862b96772\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ilerepair.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_415646a4665ad722\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sort.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_706f0bda9e6d1cac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-ktmutil.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2105d52e0161fcce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ctory-rll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_3011035c4c32dacf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..libraries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b64f2d1a0974f6b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Comparison_Operators.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-advpack.resources_31bf3856ad364e35_8.0.7600.16385_fr-fr_f43b3d62d3eb720a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_cd9932e5aaee1f78\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_es-es_7d8445a5fca61fed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\icon.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_a45d44bd1a0af822\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\msil_microsoft.windows.d..gprogress.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a39160ac6da820d4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..sh-helper.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c0931bea9bee7b31\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..-migregdb.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1ca70dcf3b660d8f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..tions-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aca7b5b92568c873\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..tptracing.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0fdea5c1cbf709f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_Switch.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-btpanui-mui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e781da033669b485\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\wow64_microsoft-windows-b..smcnative.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_3e05bdf0fe58f40a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a56cb41c8b19254a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_mdmtdk.inf_31bf3856ad364e35_6.1.7600.16385_none_189823581f4ffba3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_es-es_92a65a18e6532ae7\settings.html 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..tcmdtools.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_dba8075ccc047f21\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\msil_servicemodelreg.resources_b03f5f7f11d50a3a_6.1.7601.17514_de-de_c04f32e4dcb1a2a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-keymgr.resources_31bf3856ad364e35_6.1.7600.16385_es-es_edfd063ca192ad52\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4827f5a0b6c3696b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_7.1.7601.16492_nb-no_dae871a6bae004d3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\trad_settings.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-ra.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_43594f1f71ec2250\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_6.1.7600.16385_none_73076dd9cf3a9dce\Windows Battery Critical.wav 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\winsxs\x86_microsoft-windows-lmhsvc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_135b000d2a3b8a11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tg\ = "MNTKGDXODBUCVOD" 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD\DefaultIcon 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5vPl3Y4523Ek90l.exe,0" 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD\shell 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5vPl3Y4523Ek90l.exe" 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tg 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD\ = "CRYPTED!" 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD\shell\open\command 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD\shell\open 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1488