Overview
overview
10Static
static
1007ba533a69...53.exe
windows7-x64
107ba533a69...53.exe
windows10-2004-x64
10e971ff0e7...8d.exe
windows7-x64
80e971ff0e7...8d.exe
windows10-2004-x64
8111fb06de8...8b.exe
windows7-x64
9111fb06de8...8b.exe
windows10-2004-x64
92de3cea3eb...a8.exe
windows7-x64
12de3cea3eb...a8.exe
windows10-2004-x64
1327a2a4916...ca.exe
windows7-x64
8327a2a4916...ca.exe
windows10-2004-x64
836c10a3e1f...d9.exe
windows7-x64
136c10a3e1f...d9.exe
windows10-2004-x64
867bf260c3e...10.exe
windows7-x64
867bf260c3e...10.exe
windows10-2004-x64
870ec1874cf...ac.exe
windows7-x64
170ec1874cf...ac.exe
windows10-2004-x64
1817f5b0fcc...99.exe
windows7-x64
7817f5b0fcc...99.exe
windows10-2004-x64
7875a6185aa...f0.exe
windows7-x64
1875a6185aa...f0.exe
windows10-2004-x64
1887d386d2e...c6.exe
windows7-x64
1887d386d2e...c6.exe
windows10-2004-x64
1902afe35c6...16.exe
windows7-x64
10902afe35c6...16.exe
windows10-2004-x64
1097b6e51df2...0a.exe
windows7-x64
797b6e51df2...0a.exe
windows10-2004-x64
7a4704be3a7...72.exe
windows7-x64
1a4704be3a7...72.exe
windows10-2004-x64
1b21f34ecfa...73.exe
windows7-x64
9b21f34ecfa...73.exe
windows10-2004-x64
9b75b3ff656...52.exe
windows7-x64
8b75b3ff656...52.exe
windows10-2004-x64
8Analysis
-
max time kernel
168s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-01-2024 14:39
Behavioral task
behavioral1
Sample
07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral8
Sample
2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral14
Sample
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral18
Sample
817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral20
Sample
875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral24
Sample
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral26
Sample
97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral28
Sample
a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral30
Sample
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral32
Sample
b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
-
Size
662KB
-
MD5
b6c70f89f19670923f3f490ed5331395
-
SHA1
24c9df54d779be27508203666dc48a3fdabb0b87
-
SHA256
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b
-
SHA512
8a49a73c4086be3ae657452816070d7bf79dc653a9a7c783262348788ee80584c4456e3056f1427f4f1b8433de54437b996bfbede100430b2f7168c130511b0b
-
SSDEEP
12288:IG86nitqrIT6Eqk56i258EJsUQUUJ9LBHd2Uo:57itqr3e6d18J9LBHd2n
Malware Config
Signatures
-
Renames multiple (1289) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Videos\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGJJX6R8\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C87Z4NFH\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Music\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H48RL54X\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5GBYI9E8\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Pictures\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Libraries\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Desktop\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Downloads\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Documents\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Desktop\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Links\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\KNIV5ME6\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Videos\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Favorites\Links for United States\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Favorites\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\$Recycle.Bin\S-1-5-21-3308111660-3636268597-2291490419-1000\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Music\Sample Music\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created F:\$RECYCLE.BIN\S-1-5-21-3308111660-3636268597-2291490419-1000\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Searches\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Recorded TV\Sample Media\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Microsoft Games\Hearts\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Microsoft Games\Mahjong\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Pictures\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Videos\Sample Videos\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Downloads\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VI8FIP40\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Microsoft Games\FreeCell\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Music\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regedit.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14831_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Austin.thmx 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\PREVIEW.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14997_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Common Files\Services\verisign.bmp 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCH.DLL 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14793_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\settings.html 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\DADSHIRT.HTM 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Apothecary.thmx 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10358_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows NT\Accessories\ja-JP\wordpad.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\THMBNAIL.PNG 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14710_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.HTM 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DBGHELP.DLL 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\ShowProtect.ico 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\msdatt.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14692_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\ECLIPSE.ELM 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\STUDIO.ELM 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\THMBNAIL.PNG 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14531_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\WATERMAR.ELM 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\EXPEDITN.INF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\fr-FR\wab32res.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143748.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB01741L.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14539_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\ado\msado21.tlb 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10299_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\WaitUnblock.doc 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PAWPRINT.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sqlceqp35.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\PREVIEW.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\drag.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\gadget.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\CheckpointPop.html 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\PipelineSegments.store 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\VideoLAN\VLC\Documentation.url 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBENDF98.CHM 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Windows Sidebar\sbdrop.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\EEINTL.DLL 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\PREVIEW.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\PREVIEW.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe -
Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\TSSysprep.log 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\msdfmap.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\notepad.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\PFRO.log 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\setupact.log 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\Starter.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\bootstat.dat 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\fveupdate.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\HelpPane.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\system.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\twain.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\splwow64.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\DtcInstall.log 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\hh.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\mib.bin 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\bfsvc.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\explorer.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe"C:\Users\Admin\AppData\Local\Temp\111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2856