Overview
overview
10Static
static
6516874.exe
windows7-x64
75479329c03...a2.exe
windows7-x64
1054ab323053...1f.exe
windows7-x64
95600.exe
windows7-x64
656a9736b82...7a.exe
windows7-x64
1059ddf36a9e...ws.dll
windows7-x64
105C53687F73...ViR.js
windows7-x64
35bfae47c9f..._2.dll
windows7-x64
15c6416f819...be.exe
windows7-x64
15f1fcdfb95...1c.exe
windows7-x64
105fc9230812...e9.exe
windows7-x64
961318fa1f1...5F.exe
windows7-x64
761318fa1f1...5B.exe
windows7-x64
76184f1def4...ss.exe
windows7-x64
761bc10e8ed...3e.exe
windows7-x64
76217ea6bb8...f5.apk
windows7-x64
362ebcfeeff...C3.exe
windows7-x64
762ebcfeeff...BB.exe
windows7-x64
7647f242.exe.vir.exe
windows7-x64
964bfea1efc...99.exe
windows7-x64
964f540a7c6...B3.exe
windows7-x64
764f540a7c6...77.exe
windows7-x64
76916a006c4...9a.exe
windows7-x64
769ee634973...df.exe
windows7-x64
6f772eb660...bc.exe
windows7-x64
77077437251...e9.exe
windows7-x64
17175d6bb11...2b.exe
windows7-x64
9728733095f...on.dll
windows7-x64
873c3d88d0d...5F.exe
windows7-x64
773c3d88d0d...BF.exe
windows7-x64
774add6536c...ef.exe
windows7-x64
10757a661bcc...d8.exe
windows7-x64
7Analysis
- max time kernel
840s - max time network
842s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
22/11/2024, 02:36
Behavioral task
behavioral1
Sample
516874.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
1200 seconds
Behavioral task
behavioral2
Sample
5479329c03e12e27adc81caeefe1a1dc26bf59d4dac36dd2eae008213e8fe0a2.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
1200 seconds
Behavioral task
behavioral3
Sample
54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
1200 seconds
Behavioral task
behavioral4
Sample
5600.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
1200 seconds
Behavioral task
behavioral5
Sample
56a9736b82bc9f65ddad590d1edfd9df26b5d97ecfeb48787f6ccc00ce26597a.exe
Resource
win7-20241023-en
windows7-x64
8 signatures
1200 seconds
Behavioral task
behavioral6
Sample
59ddf36a9e85f4cf82a6511b49cfcdd9e4521b17f7e245f005e18418176ff4aa_PonyNews.dll
Resource
win7-20240903-en
windows7-x64
9 signatures
1200 seconds
Behavioral task
behavioral7
Sample
5C53687F7327933R.js.ViR.js
Resource
win7-20240903-en
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral8
Sample
5bfae47c9fda81243b50b6df53ac4184d90a70000894fa2a516044fa44770cfd_Stealer_2.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral9
Sample
5c6416f819bfbca2f1862691a03f68be.exe
Resource
win7-20241010-en
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral10
Sample
5f1fcdfb951dc4642ce136a5d3e6bc42021f8e0cd631975a5eb3842da020531c.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
1200 seconds
Behavioral task
behavioral11
Sample
5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
1200 seconds
Behavioral task
behavioral12
Sample
61318fa1f1db342045573d584badc254c9e2578db916594dc749d8cc44ce8ac4_Dumped_TDS=4F8C315F.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral13
Sample
61318fa1f1db342045573d584badc254c9e2578db916594dc749d8cc44ce8ac4_TDS=4F91F15B.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral14
Sample
6184f1def457c10b2ae10a33b8639c89cb0115061c3d424d330342b44d4179aa_not_packed_maybe_useless.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral15
Sample
61bc10e8ede3997da73b3de9fa57b059e352b592404fb9c171469c4026fdc03e.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
1200 seconds
Behavioral task
behavioral16
Sample
6217ea6bb87295983c4915a4d97c7e4142effef95d1e815693a72ea3a73b45f5.apk
Resource
win7-20240903-en
windows7-x64
6 signatures
1200 seconds
Behavioral task
behavioral17
Sample
62ebcfeeff976f3635e36544b9f6d6282a565ea6a0b4d8319d9831ce68ef26df_Dumped_TDS=4F854EC3.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral18
Sample
62ebcfeeff976f3635e36544b9f6d6282a565ea6a0b4d8319d9831ce68ef26df_TDS=4F8644BB.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral19
Sample
647f242.exe.vir.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
1200 seconds
Behavioral task
behavioral20
Sample
64bfea1efccb47a049ba2cb592878e5c415cc70f9488dd97291c1356e3d79299.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
1200 seconds
Behavioral task
behavioral21
Sample
64f540a7c6ded1c751c9a66629fd2aaa6cdd61749f05c8d0760a1aaeb5548935_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral22
Sample
64f540a7c6ded1c751c9a66629fd2aaa6cdd61749f05c8d0760a1aaeb5548935_TDS=4F9DB277.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral23
Sample
6916a006c429a3b3a76dfa8c162ddab178b5a20763493506deeb9447875d039a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral24
Sample
69ee6349739643538dd7eb60e92368f209e12a366f00a7b80000ba02307c9bdf.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral25
Sample
6f772eb660bc05fc26df86c98ca49abc.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
1200 seconds
Behavioral task
behavioral26
Sample
70774372517532ae1dcb97a7133983811d5cc7d2975cd58a1f132f2ef100c5e9.exe
Resource
win7-20240729-en
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral27
Sample
7175d6bb11dea0932bd4b611d0f7221b62a71dbc54607e97ad397f104bcffa2b.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
1200 seconds
Behavioral task
behavioral28
Sample
728733095fe2c66f91a19ebde412dd25_70186ceb735016eadd98466e62c03635_TheLastReveton.dll
Resource
win7-20240903-en
windows7-x64
6 signatures
1200 seconds
Behavioral task
behavioral29
Sample
73c3d88d0d9d1c73080bcdda423879ce9eff3aa1f26cc93d120f596091825960_Dumped_TDS=4F8C315F.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral30
Sample
73c3d88d0d9d1c73080bcdda423879ce9eff3aa1f26cc93d120f596091825960_TDS=4F8DFBBF.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral31
Sample
74add6536cdcfb8b77d10a1e7be6b9ef.exe
Resource
win7-20241010-en
windows7-x64
16 signatures
1200 seconds
Behavioral task
behavioral32
Sample
757a661bcc68616f99366b10abac92d8.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
1200 seconds
General
- Target 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe
- Size 10KB
- Sample241122-c3zrraspfs
- SHA256 e9ffda70e3ab71ee9d165abec8f2c7c52a139b71666f209d2eaf0c704569d3b1
- MD5 b14c45c1792038fd69b5c75e604242a3
- SHA1 54ab323053f1138e5ccaa8f8afaa38cabca9491f
- SHA512 fdf64a9f2be75b66af69a1ddf2c5e6fa4580587190edd0da3d0243326fc73ebabf0357b903c640458ae627789b68a5a480d7108e80d4f1eb202be386fba0f044
- SSDEEP 192:EI9ImrPAYflNL3/MnXjGpst8uVA/rMXznNdXk:dDUgXojRVATuk
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (900) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe - Deletes itself 1 IoCs
pid Process 3024 cmd.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_methods.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_format.ps1xml.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Return.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Language_Keywords.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_methods.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Path_Syntax.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_parameters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_methods.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ja-JP\about_BITS_Cmdlets.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Throw.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_pssession_details.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Variables.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_format.ps1xml.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Reserved_Words.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_logical_operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_FAQ.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_output.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Arithmetic_Operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Arithmetic_Operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_arrays.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_requires.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_If.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\de-DE\about_BITS_Cmdlets.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Ref.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Parsing.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_join.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_pssessions.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_modules.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_methods.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_do.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_scopes.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Arithmetic_Operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_environment_variables.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions_advanced_parameters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_If.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_jobs.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Command_Syntax.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_PSSnapins.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_data_sections.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Ref.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_functions_cmdletbindingattribute.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_script_internationalization.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_CommonParameters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_locations.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_FAQ.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_do.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_History.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Special_Characters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_script_blocks.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_History.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_jobs.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Variables.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_job_details.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Switch.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_escape_characters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Comment_Based_Help.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_properties.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_WS-Management_Cmdlets.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_aliases.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Comment_Based_Help.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_do.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_properties.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aadgilloaddfilln.bmp" 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe -
resource yara_rule behavioral3/memory/2012-0-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral3/memory/2012-1729-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral3/memory/2012-1730-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral3/memory/2012-1740-0x0000000000400000-0x0000000000413000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\it.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382965.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Code_Signing_2001-4_CA.cer 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMask.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\InfoPathWelcomeImage.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341634.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341654.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02069J.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImages.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dataset.zip 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287643.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0302827.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_HighMask.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIconsMask.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382950.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384862.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03380I.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImages.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImage.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dialog.zip 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\MDIParent.zip 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\SplitUnprotect.doc 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099161.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImagesMask.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145168.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178460.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\SOLVSAMP.XLS 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178632.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287644.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315612.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02738U.BMP 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\StaticText.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIconsMask.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099147.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101856.BMP 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02417U.BMP 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02746U.BMP 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIcon.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341653.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02754U.BMP 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\PASSWORD.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AboutBox.zip 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImage.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Special_Characters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_remote_FAQ.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_en-us_02e9e13998201d43\erofflps.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_Line_Editing.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_Signing.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-usertiles_31bf3856ad364e35_6.1.7600.16385_none_f385bacaa98d1e8b\usertile36.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\img5.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_preference_variables.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_trap.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp3.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_Reserved_Words.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Special_Characters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_do.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Line_Editing.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_Continue.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\SoftBlue.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp5.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_remote_requirements.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_pssession_details.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_join.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Assignment_Operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_History.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_parameters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_execution_policies.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_aliases.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_command_precedence.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_remote_troubleshooting.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_While.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_script_internationalization.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\x86_setup-uxwizard-clientimages_31bf3856ad364e35_6.1.7600.16385_none_48ada01d8ff36e68\background.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_remote_FAQ.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_CommonParameters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_remote_troubleshooting.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_PSSnapins.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_While.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_debuggers.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_remote_output.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_environment_variables.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_methods.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_pipelines.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_remote_jobs.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Comment_Based_Help.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\img1.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-ca-component_31bf3856ad364e35_6.1.7601.17514_none_fae061a2e0ae5019\CA-wp4.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp2.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_WMI_Cmdlets.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_remote_jobs.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_Arithmetic_Operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\default.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Arithmetic_Operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_815d27dbb889ba17\Tulip.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_prompts.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-usertiles_31bf3856ad364e35_6.1.7600.16385_none_f385bacaa98d1e8b\usertile24.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-usertiles_31bf3856ad364e35_6.1.7600.16385_none_f385bacaa98d1e8b\usertile42.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_Break.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\ASPdotNET_logo.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_WMI_Cmdlets.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft.backgroun..nt.module.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1a0ca3a01119ca4b\about_BITS_Cmdlets.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Comparison_Operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft.backgroun..nt.module.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8dbf2e4c46ccd2f2\about_BITS_Cmdlets.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp4.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\Tasks\SCHEDLGU.TXT 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\GreenBubbles.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1948 NOTEPAD.EXE - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1948 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 30 PID 2012 wrote to memory of 1948 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 30 PID 2012 wrote to memory of 1948 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 30 PID 2012 wrote to memory of 1948 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 30 PID 2012 wrote to memory of 3024 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 33 PID 2012 wrote to memory of 3024 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 33 PID 2012 wrote to memory of 3024 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 33 PID 2012 wrote to memory of 3024 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe"C:\Users\Admin\AppData\Local\Temp\54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW TO DECRYPT FILES.txt2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1948
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ntfs_system.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg
- Size 2KB
- SHA256 1295fcd13cd3fedf3f37f5b51c4556dd2742ec92bf756de6e9ae45758a0b28d3
- MD5 5a0718482ef07b840af97448370bf69d
- SHA1 67f9d84ca07ed1ac336f0d6b04c8e711e88ef1ee
- SHA512 ca0dcb5472b2ba3c3ef52d13206cca8e7fd0f859dbb9cb7fb1912223ace2669b681e9a68e81a6d2f3cf191de34d5eca4f0c670c715c44aa79fae628e10088557
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp
- Size 2KB
- SHA256 9f59ff35f89b7a280a65916dd202ec9df372b698a689522d4328e7ace19208fa
- MD5 38420ab0c3e48108fd91e34d3f1b899f
- SHA1 71e309179c0a67e30b1b80c1304a8afdbce0dc8f
- SHA512 bc122b75905d88b88ebe2311262fb372661c100de380ecbd751356ec262a49e9fd785cadad2c4ca5b71c372ed020e4d533d464aa7da73470eb102991ccfaacae
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
- Size 6KB
- SHA256 685fcc3832f1c70008a11e0b295eac4a8610d588327e0c3e144727d3778899a5
- MD5 d35a3a599c4eb1db010f45e8a2eafc99
- SHA1 c3fb9c11815ca694e0c877bd4ac9d76e6db52cd5
- SHA512 e835d819f2f73cb7dd3b9deedcb5a439065371bb6c910a79d6a16ce9c6caf46e0c9314dc72910737a30b6c999fa23e465a2fd5dee6cd1c3ae611db2b702ca816
- SSDEEP 96:U1Qyk8/dniGYfqi5XqIRXPlIT0Jea+t9VoE3zm66Fd+HCHGrBKrPyv9SiN7S5Gqv:dykUnDYii5fl/p+tIVuHxsTUwf5GqGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
- Size 3KB
- SHA256 060fab7d708ad3568115f021e86206cb9ddc26188482e4f1e28b499d48ee1660
- MD5 cb9cc5909edee21d11579e272638c15e
- SHA1 18b79e7afc232dbf73cc5d52194f9b23e7e0f901
- SHA512 8a65615d876de51c13e9efd113e075aae93b1643bcd6805e826ab99f50fb986b86a605e5ecc915af3ca6753bbc545657f41bfd9de10d76727025d1a843b01f90
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
- Size 5KB
- SHA256 fd9b7a9e47b2e2dbbbec7c62e7fae290ffa1f1fb823b7dadb05274e36a317c91
- MD5 8b1a34259cebf1a065a1bc558456465f
- SHA1 981936b5d51c28d9fc37656b40365c8abfcf2cf6
- SHA512 71cf25b6b267478bfcb0b30922fc0b0e45827141bc1a1833762508d34647c2fc0b44984900a2e674e97fece96b02afa1274d7dcf6ab2a2fee7cd33524bba2b8c
- SSDEEP 96:92dsuIFBOjg2JtZp3zwGC5Z3AigD5MdtbZPAVwzVdG1MHt9Vnwe1f:9Osdu1JF30V5lgNMtKwvftHwe1f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp
- Size 1KB
- SHA256 ef18be5096a89ddc597e7251b0a40f4ed3102ebba838aab07af0655ad18d56b3
- MD5 28f4f85fef0345ea64df97b8dcfb606e
- SHA1 91133b6ab1e6d54155f5b5d690a46d03c66ea48c
- SHA512 76037d1ca1441639bd37e69844c3bd571acc31f43fde0968a1f1512dad62d038bbd2b2f359ef681c7eb9cb183f4d2a831bf19da3499e05f25dbca04ea9c5bc31
- MD5 SHA1 SHA512
- Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
- Size 11KB
- SHA256 a0d598d26b6592cf1f2e39d6274fee42e0c472d6ffae57459c621e4bee27cddf
- MD5 55902ac38081b9109033255caa78b73d
- SHA1 9162a92fc89810b6c602e7c47b95ada70b656995
- SHA512 508fb7e6a1deb7aef07d744d82ccf985ff10ace01fc4673e553e1d48f6fd6160d51cdd8eaaaa2618c4724f62ecec6666cb0309453aa1e3a9193866cfb39cd58a
- SSDEEP 192:iS0ekpxtRmS3Z4E1lEQOgS7G8P7a2UwWjq2R594drFjuHYx5dvTrLh3kTSEn7Hbi:ih9lRm6f1POk8P7k5jq2RvmNz5VrlkTs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
- Size 109KB
- SHA256 ad95bb4284b818b0c8630d2e4ac52ee719789afd4e159b2cac882706bea665dc
- MD5 a15ae8354127e175e8e54b9eb1541073
- SHA1 55655734f9a479f19d09f8b878759005533d6b8d
- SHA512 fda840f096d2df28c02f70e46830df3e9cb90d0e9dc07f97573e1ba7ab00fdee3b0d01697ffbeabb691473f0b8affa23373a732c017a6e08f897cd712ec05802
- SSDEEP 3072:ZcPeFcrqmfbL/JUk/HjSO40Hx9MlZ9KH4O:ZcGFcrqe1UW4Wx9Ei
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
- Size 172KB
- SHA256 c3fcb24d6ef994b87703c5993a1e39fa34ec999db658d9479185f1ae90254c13
- MD5 45c4bb943958de2bca1125dd322149c1
- SHA1 52eea97baecc24007f221e6001bd4cbfb0c46d8c
- SHA512 c37fbebe7062b4b72bc62ed6cc40a7072e75c6a6e05dd015d1df276ac49060e4973569bb2f48e51e26c3417b09776f698169aa1880cc95dfc62404a3d2e6a9f9
- SSDEEP 3072:sF0Fpf6P2q24zfQmX2DK90q8J3G1qzFhKdXNhalQxkM8Qa4AMWNyYCVfl90Tq7VF:wCw5bzfVX2OZ8zHQoyza6m+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ntfs_system.bat
- Size 92B
- SHA256 002747d89fc8251c1bbcd1207163efcaa203a7feec1798fa7a8a453ce780f181
- MD5 d932c861983a57ca4261d47d9b3e96a1
- SHA1 d69d492b422c58214fbb5da196fde1b0d98361ee
- SHA512 d0806dd89cf2d17a6f8ccf3bc0cbd7569730a829fc9cae7e61c96595fa83edc1ce74b9ddba3de3100af6b6d98f51832aa42bef3441273f5c141a14d692f254bc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\HOW TO DECRYPT FILES.txt
- Size 1KB
- SHA256 be1c4a9b520c2d1f408c46c99cf465fd561027c33b6d13f491bfe0e4afa12636
- MD5 05024d953f6a27da82e367bbfd0a93a7
- SHA1 9ef59e1b72c562ee42bd8bfef21359bfcc5212e2
- SHA512 f16a92fbe7204b16d8b15534e11f0ab5dcb9cb3133a2cd515a4220aa0e896d12be801bdd0050533bb85242492c0ded5145cdd48805cd43659c12af106e553942
- MD5 SHA1 SHA512
- Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk
- Size 1KB
- SHA256 2812834914f63664e0849381a5d32e6b17a46d57294aed61d7ad55eb3350353c
- MD5 05d1d3fda7e3a0d96b94ef4590442eb2
- SHA1 4858ce95be6e8c077f67293c7e2881e32a866319
- SHA512 7ad4bbf23a0ce5b23ab6fde405d32d30da0001e373c9c9d10dfed2d736f39f03f9ccd184a468345e4886c7a9d52e484b60108a531bcd5dc10e21e0bbdf78e530
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
- Size 21KB
- SHA256 4482a4073699b029665660f35226e2929b1997203cb965e5332ab1a2cba0a250
- MD5 892cf8129a5bb99a8a092f6352e19911
- SHA1 a5232c32e6e5aac8a8c17af10edaf6f2e30052a3
- SHA512 6f8fd27c5023e580c94b2febbbd759d804c8e739711b573ccf4271bc23da6d8296b3a1c339eefc7cb690759268499b4179f2e6acfb017378e76dec261b07fb46
- SSDEEP 384:TfYyPnc7J+Z43Bo6RJHRuJEm7Kxaw+V2c8ewvpB4XZEy:TfjPnE047uyMKxycc8fsXZT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
- Size 8KB
- SHA256 e841276f10eea8b39fe22d4a6233fbc4dada0e601b9bf016506f9e7608f52177
- MD5 1de9fdbeafad3ce862101bed226b285d
- SHA1 a75556e9ed8ec21cccb422f7b7a374b07f46724e
- SHA512 7bd8b57164c979fbbb60421f89402929282da8f082e48e5d3acf0b8471d6122b797ab3ada0b5b8115da63b28bd05aef18b69f444b02396fb58459b053c85c229
- SSDEEP 192:oAvq+2Vw9tAbLtrKruSa6buNWmy0/7lmKA:NveVwSEiQmXhhtA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg
- Size 1KB
- SHA256 1295dc0d54e8c0ce0231af11782a665a894b32259c7bc846763474cbaf6bb2fb
- MD5 79cba0c74b13aa86b5d6ad7f3bfded31
- SHA1 d60a9a349af7f9868d8126bb9a1997ee63a5c762
- SHA512 5192be59316427ae2545dd9b1ef78b375a5d73aaaed7ae7d9a970e35dfe9049be67150dd151df42efab5ddfb7b0540aaa991188acba3984812ed4f220bd9c6ad
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg
- Size 53B
- SHA256 1748e668cb5ada5e6cd9d5fc65c1b3e0e618df143634a610a0d4a277323c4b77
- MD5 2837297f3485b513149a91204d2493ff
- SHA1 3eff016558f31a58fccd86a4c236b1063a8c469a
- SHA512 9304a56110ed0febe465c60dafd32fe27dd9d961d9c828de756bf7bab2814edb94092fc5c6da0a352c239a4406eb6794a59a751e04cc98004eec656b2d57903a
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
- Size 8KB
- SHA256 2516e4ef0dad07775128f80551676a32d04a1be0617a8dfc78360f4f78f0c79b
- MD5 90caae9596e9d0b8197b2a8bccbdbda9
- SHA1 9f63f4b3e4cb084213b180ceb99b7c63e4c28171
- SHA512 d5f83a61efce02458dc42dff98a2e4fcd4e9cfdf0caf404c44167003d6ce2c483affad5a599f1afe07c90f7cecba19124b16b00ebd8504a6a6a7b7b0da653e1c
- SSDEEP 96:OZ8EKA9XxqBCHMtTaRmvyKD899ZXtuGE8my7l0I0n4k77Z8CYZ5KSs8hs:xEKAvq+Mt7yCop3my0nF71yK/N
- MD5 SHA1 SHA512 SSDEEP
