Overview
overview
10Static
static
6516874.exe
windows7-x64
75479329c03...a2.exe
windows7-x64
1054ab323053...1f.exe
windows7-x64
95600.exe
windows7-x64
656a9736b82...7a.exe
windows7-x64
1059ddf36a9e...ws.dll
windows7-x64
105C53687F73...ViR.js
windows7-x64
35bfae47c9f..._2.dll
windows7-x64
15c6416f819...be.exe
windows7-x64
15f1fcdfb95...1c.exe
windows7-x64
105fc9230812...e9.exe
windows7-x64
961318fa1f1...5F.exe
windows7-x64
761318fa1f1...5B.exe
windows7-x64
76184f1def4...ss.exe
windows7-x64
761bc10e8ed...3e.exe
windows7-x64
76217ea6bb8...f5.apk
windows7-x64
362ebcfeeff...C3.exe
windows7-x64
762ebcfeeff...BB.exe
windows7-x64
7647f242.exe.vir.exe
windows7-x64
964bfea1efc...99.exe
windows7-x64
964f540a7c6...B3.exe
windows7-x64
764f540a7c6...77.exe
windows7-x64
76916a006c4...9a.exe
windows7-x64
769ee634973...df.exe
windows7-x64
6f772eb660...bc.exe
windows7-x64
77077437251...e9.exe
windows7-x64
17175d6bb11...2b.exe
windows7-x64
9728733095f...on.dll
windows7-x64
873c3d88d0d...5F.exe
windows7-x64
773c3d88d0d...BF.exe
windows7-x64
774add6536c...ef.exe
windows7-x64
10757a661bcc...d8.exe
windows7-x64
7Analysis
-
max time kernel
840s -
max time network
842s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 02:36
Behavioral task
behavioral1
Sample
516874.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
5479329c03e12e27adc81caeefe1a1dc26bf59d4dac36dd2eae008213e8fe0a2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral3
Sample
54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
5600.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral5
Sample
56a9736b82bc9f65ddad590d1edfd9df26b5d97ecfeb48787f6ccc00ce26597a.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral6
Sample
59ddf36a9e85f4cf82a6511b49cfcdd9e4521b17f7e245f005e18418176ff4aa_PonyNews.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
5C53687F7327933R.js.ViR.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
5bfae47c9fda81243b50b6df53ac4184d90a70000894fa2a516044fa44770cfd_Stealer_2.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral9
Sample
5c6416f819bfbca2f1862691a03f68be.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
5f1fcdfb951dc4642ce136a5d3e6bc42021f8e0cd631975a5eb3842da020531c.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
61318fa1f1db342045573d584badc254c9e2578db916594dc749d8cc44ce8ac4_Dumped_TDS=4F8C315F.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral13
Sample
61318fa1f1db342045573d584badc254c9e2578db916594dc749d8cc44ce8ac4_TDS=4F91F15B.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
6184f1def457c10b2ae10a33b8639c89cb0115061c3d424d330342b44d4179aa_not_packed_maybe_useless.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral15
Sample
61bc10e8ede3997da73b3de9fa57b059e352b592404fb9c171469c4026fdc03e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
6217ea6bb87295983c4915a4d97c7e4142effef95d1e815693a72ea3a73b45f5.apk
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
62ebcfeeff976f3635e36544b9f6d6282a565ea6a0b4d8319d9831ce68ef26df_Dumped_TDS=4F854EC3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
62ebcfeeff976f3635e36544b9f6d6282a565ea6a0b4d8319d9831ce68ef26df_TDS=4F8644BB.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
647f242.exe.vir.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
64bfea1efccb47a049ba2cb592878e5c415cc70f9488dd97291c1356e3d79299.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral21
Sample
64f540a7c6ded1c751c9a66629fd2aaa6cdd61749f05c8d0760a1aaeb5548935_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
64f540a7c6ded1c751c9a66629fd2aaa6cdd61749f05c8d0760a1aaeb5548935_TDS=4F9DB277.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
6916a006c429a3b3a76dfa8c162ddab178b5a20763493506deeb9447875d039a.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
69ee6349739643538dd7eb60e92368f209e12a366f00a7b80000ba02307c9bdf.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral25
Sample
6f772eb660bc05fc26df86c98ca49abc.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
70774372517532ae1dcb97a7133983811d5cc7d2975cd58a1f132f2ef100c5e9.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral27
Sample
7175d6bb11dea0932bd4b611d0f7221b62a71dbc54607e97ad397f104bcffa2b.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
728733095fe2c66f91a19ebde412dd25_70186ceb735016eadd98466e62c03635_TheLastReveton.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
73c3d88d0d9d1c73080bcdda423879ce9eff3aa1f26cc93d120f596091825960_Dumped_TDS=4F8C315F.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
73c3d88d0d9d1c73080bcdda423879ce9eff3aa1f26cc93d120f596091825960_TDS=4F8DFBBF.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral31
Sample
74add6536cdcfb8b77d10a1e7be6b9ef.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral32
Sample
757a661bcc68616f99366b10abac92d8.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe
-
Size
10KB
-
MD5
b14c45c1792038fd69b5c75e604242a3
-
SHA1
54ab323053f1138e5ccaa8f8afaa38cabca9491f
-
SHA256
e9ffda70e3ab71ee9d165abec8f2c7c52a139b71666f209d2eaf0c704569d3b1
-
SHA512
fdf64a9f2be75b66af69a1ddf2c5e6fa4580587190edd0da3d0243326fc73ebabf0357b903c640458ae627789b68a5a480d7108e80d4f1eb202be386fba0f044
-
SSDEEP
192:EI9ImrPAYflNL3/MnXjGpst8uVA/rMXznNdXk:dDUgXojRVATuk
Malware Config
Signatures
-
Renames multiple (900) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe -
Deletes itself 1 IoCs
pid Process 3024 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_methods.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_format.ps1xml.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Return.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Language_Keywords.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_methods.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Path_Syntax.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_parameters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_methods.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ja-JP\about_BITS_Cmdlets.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Throw.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_pssession_details.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Variables.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_format.ps1xml.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Reserved_Words.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_logical_operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_FAQ.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_output.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Arithmetic_Operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Arithmetic_Operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_arrays.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_requires.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_If.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\de-DE\about_BITS_Cmdlets.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Ref.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Parsing.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_join.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_pssessions.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_modules.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_methods.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_do.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_scopes.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Arithmetic_Operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_environment_variables.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions_advanced_parameters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_If.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_jobs.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Command_Syntax.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_PSSnapins.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_data_sections.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Ref.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_functions_cmdletbindingattribute.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_script_internationalization.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_CommonParameters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_locations.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_FAQ.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_do.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_History.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Special_Characters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_script_blocks.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_History.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_jobs.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Variables.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_job_details.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Switch.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_escape_characters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Comment_Based_Help.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_properties.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_WS-Management_Cmdlets.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_aliases.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Comment_Based_Help.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_do.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_properties.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aadgilloaddfilln.bmp" 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe -
resource yara_rule behavioral3/memory/2012-0-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral3/memory/2012-1729-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral3/memory/2012-1730-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral3/memory/2012-1740-0x0000000000400000-0x0000000000413000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\it.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382965.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Code_Signing_2001-4_CA.cer 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMask.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\InfoPathWelcomeImage.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341634.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341654.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02069J.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImages.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dataset.zip 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287643.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0302827.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_HighMask.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIconsMask.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382950.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384862.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03380I.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImages.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImage.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dialog.zip 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\MDIParent.zip 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\SplitUnprotect.doc 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099161.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImagesMask.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145168.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178460.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\SOLVSAMP.XLS 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178632.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287644.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315612.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02738U.BMP 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\StaticText.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIconsMask.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099147.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101856.BMP 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02417U.BMP 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02746U.BMP 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIcon.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341653.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02754U.BMP 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\PASSWORD.JPG 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AboutBox.zip 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImage.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Special_Characters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_remote_FAQ.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_en-us_02e9e13998201d43\erofflps.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_Line_Editing.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_Signing.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-usertiles_31bf3856ad364e35_6.1.7600.16385_none_f385bacaa98d1e8b\usertile36.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\img5.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_preference_variables.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_trap.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp3.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_Reserved_Words.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Special_Characters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_do.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Line_Editing.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_Continue.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\SoftBlue.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp5.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_remote_requirements.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_pssession_details.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_join.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Assignment_Operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_History.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_parameters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_execution_policies.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_aliases.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_command_precedence.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_remote_troubleshooting.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_While.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_script_internationalization.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\x86_setup-uxwizard-clientimages_31bf3856ad364e35_6.1.7600.16385_none_48ada01d8ff36e68\background.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_remote_FAQ.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_CommonParameters.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_remote_troubleshooting.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_PSSnapins.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_While.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_debuggers.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_remote_output.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_environment_variables.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_methods.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_pipelines.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_remote_jobs.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Comment_Based_Help.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\img1.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-ca-component_31bf3856ad364e35_6.1.7601.17514_none_fae061a2e0ae5019\CA-wp4.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp2.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_WMI_Cmdlets.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_remote_jobs.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_Arithmetic_Operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\default.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Arithmetic_Operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_815d27dbb889ba17\Tulip.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_prompts.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-usertiles_31bf3856ad364e35_6.1.7600.16385_none_f385bacaa98d1e8b\usertile24.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-usertiles_31bf3856ad364e35_6.1.7600.16385_none_f385bacaa98d1e8b\usertile42.bmp 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_Break.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\ASPdotNET_logo.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_WMI_Cmdlets.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft.backgroun..nt.module.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1a0ca3a01119ca4b\about_BITS_Cmdlets.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Comparison_Operators.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\wow64_microsoft.backgroun..nt.module.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8dbf2e4c46ccd2f2\about_BITS_Cmdlets.help.txt 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp4.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\Tasks\SCHEDLGU.TXT 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\GreenBubbles.jpg 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1948 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1948 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 30 PID 2012 wrote to memory of 1948 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 30 PID 2012 wrote to memory of 1948 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 30 PID 2012 wrote to memory of 1948 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 30 PID 2012 wrote to memory of 3024 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 33 PID 2012 wrote to memory of 3024 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 33 PID 2012 wrote to memory of 3024 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 33 PID 2012 wrote to memory of 3024 2012 54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe"C:\Users\Admin\AppData\Local\Temp\54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW TO DECRYPT FILES.txt2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1948
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ntfs_system.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg
Filesize2KB
MD55a0718482ef07b840af97448370bf69d
SHA167f9d84ca07ed1ac336f0d6b04c8e711e88ef1ee
SHA2561295fcd13cd3fedf3f37f5b51c4556dd2742ec92bf756de6e9ae45758a0b28d3
SHA512ca0dcb5472b2ba3c3ef52d13206cca8e7fd0f859dbb9cb7fb1912223ace2669b681e9a68e81a6d2f3cf191de34d5eca4f0c670c715c44aa79fae628e10088557
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp
Filesize2KB
MD538420ab0c3e48108fd91e34d3f1b899f
SHA171e309179c0a67e30b1b80c1304a8afdbce0dc8f
SHA2569f59ff35f89b7a280a65916dd202ec9df372b698a689522d4328e7ace19208fa
SHA512bc122b75905d88b88ebe2311262fb372661c100de380ecbd751356ec262a49e9fd785cadad2c4ca5b71c372ed020e4d533d464aa7da73470eb102991ccfaacae
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
Filesize6KB
MD5d35a3a599c4eb1db010f45e8a2eafc99
SHA1c3fb9c11815ca694e0c877bd4ac9d76e6db52cd5
SHA256685fcc3832f1c70008a11e0b295eac4a8610d588327e0c3e144727d3778899a5
SHA512e835d819f2f73cb7dd3b9deedcb5a439065371bb6c910a79d6a16ce9c6caf46e0c9314dc72910737a30b6c999fa23e465a2fd5dee6cd1c3ae611db2b702ca816
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
Filesize3KB
MD5cb9cc5909edee21d11579e272638c15e
SHA118b79e7afc232dbf73cc5d52194f9b23e7e0f901
SHA256060fab7d708ad3568115f021e86206cb9ddc26188482e4f1e28b499d48ee1660
SHA5128a65615d876de51c13e9efd113e075aae93b1643bcd6805e826ab99f50fb986b86a605e5ecc915af3ca6753bbc545657f41bfd9de10d76727025d1a843b01f90
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
Filesize5KB
MD58b1a34259cebf1a065a1bc558456465f
SHA1981936b5d51c28d9fc37656b40365c8abfcf2cf6
SHA256fd9b7a9e47b2e2dbbbec7c62e7fae290ffa1f1fb823b7dadb05274e36a317c91
SHA51271cf25b6b267478bfcb0b30922fc0b0e45827141bc1a1833762508d34647c2fc0b44984900a2e674e97fece96b02afa1274d7dcf6ab2a2fee7cd33524bba2b8c
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp
Filesize1KB
MD528f4f85fef0345ea64df97b8dcfb606e
SHA191133b6ab1e6d54155f5b5d690a46d03c66ea48c
SHA256ef18be5096a89ddc597e7251b0a40f4ed3102ebba838aab07af0655ad18d56b3
SHA51276037d1ca1441639bd37e69844c3bd571acc31f43fde0968a1f1512dad62d038bbd2b2f359ef681c7eb9cb183f4d2a831bf19da3499e05f25dbca04ea9c5bc31
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
Filesize11KB
MD555902ac38081b9109033255caa78b73d
SHA19162a92fc89810b6c602e7c47b95ada70b656995
SHA256a0d598d26b6592cf1f2e39d6274fee42e0c472d6ffae57459c621e4bee27cddf
SHA512508fb7e6a1deb7aef07d744d82ccf985ff10ace01fc4673e553e1d48f6fd6160d51cdd8eaaaa2618c4724f62ecec6666cb0309453aa1e3a9193866cfb39cd58a
-
Filesize
109KB
MD5a15ae8354127e175e8e54b9eb1541073
SHA155655734f9a479f19d09f8b878759005533d6b8d
SHA256ad95bb4284b818b0c8630d2e4ac52ee719789afd4e159b2cac882706bea665dc
SHA512fda840f096d2df28c02f70e46830df3e9cb90d0e9dc07f97573e1ba7ab00fdee3b0d01697ffbeabb691473f0b8affa23373a732c017a6e08f897cd712ec05802
-
Filesize
172KB
MD545c4bb943958de2bca1125dd322149c1
SHA152eea97baecc24007f221e6001bd4cbfb0c46d8c
SHA256c3fcb24d6ef994b87703c5993a1e39fa34ec999db658d9479185f1ae90254c13
SHA512c37fbebe7062b4b72bc62ed6cc40a7072e75c6a6e05dd015d1df276ac49060e4973569bb2f48e51e26c3417b09776f698169aa1880cc95dfc62404a3d2e6a9f9
-
Filesize
92B
MD5d932c861983a57ca4261d47d9b3e96a1
SHA1d69d492b422c58214fbb5da196fde1b0d98361ee
SHA256002747d89fc8251c1bbcd1207163efcaa203a7feec1798fa7a8a453ce780f181
SHA512d0806dd89cf2d17a6f8ccf3bc0cbd7569730a829fc9cae7e61c96595fa83edc1ce74b9ddba3de3100af6b6d98f51832aa42bef3441273f5c141a14d692f254bc
-
Filesize
1KB
MD505024d953f6a27da82e367bbfd0a93a7
SHA19ef59e1b72c562ee42bd8bfef21359bfcc5212e2
SHA256be1c4a9b520c2d1f408c46c99cf465fd561027c33b6d13f491bfe0e4afa12636
SHA512f16a92fbe7204b16d8b15534e11f0ab5dcb9cb3133a2cd515a4220aa0e896d12be801bdd0050533bb85242492c0ded5145cdd48805cd43659c12af106e553942
-
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk
Filesize1KB
MD505d1d3fda7e3a0d96b94ef4590442eb2
SHA14858ce95be6e8c077f67293c7e2881e32a866319
SHA2562812834914f63664e0849381a5d32e6b17a46d57294aed61d7ad55eb3350353c
SHA5127ad4bbf23a0ce5b23ab6fde405d32d30da0001e373c9c9d10dfed2d736f39f03f9ccd184a468345e4886c7a9d52e484b60108a531bcd5dc10e21e0bbdf78e530
-
Filesize
21KB
MD5892cf8129a5bb99a8a092f6352e19911
SHA1a5232c32e6e5aac8a8c17af10edaf6f2e30052a3
SHA2564482a4073699b029665660f35226e2929b1997203cb965e5332ab1a2cba0a250
SHA5126f8fd27c5023e580c94b2febbbd759d804c8e739711b573ccf4271bc23da6d8296b3a1c339eefc7cb690759268499b4179f2e6acfb017378e76dec261b07fb46
-
Filesize
8KB
MD51de9fdbeafad3ce862101bed226b285d
SHA1a75556e9ed8ec21cccb422f7b7a374b07f46724e
SHA256e841276f10eea8b39fe22d4a6233fbc4dada0e601b9bf016506f9e7608f52177
SHA5127bd8b57164c979fbbb60421f89402929282da8f082e48e5d3acf0b8471d6122b797ab3ada0b5b8115da63b28bd05aef18b69f444b02396fb58459b053c85c229
-
Filesize
1KB
MD579cba0c74b13aa86b5d6ad7f3bfded31
SHA1d60a9a349af7f9868d8126bb9a1997ee63a5c762
SHA2561295dc0d54e8c0ce0231af11782a665a894b32259c7bc846763474cbaf6bb2fb
SHA5125192be59316427ae2545dd9b1ef78b375a5d73aaaed7ae7d9a970e35dfe9049be67150dd151df42efab5ddfb7b0540aaa991188acba3984812ed4f220bd9c6ad
-
Filesize
53B
MD52837297f3485b513149a91204d2493ff
SHA13eff016558f31a58fccd86a4c236b1063a8c469a
SHA2561748e668cb5ada5e6cd9d5fc65c1b3e0e618df143634a610a0d4a277323c4b77
SHA5129304a56110ed0febe465c60dafd32fe27dd9d961d9c828de756bf7bab2814edb94092fc5c6da0a352c239a4406eb6794a59a751e04cc98004eec656b2d57903a
-
Filesize
8KB
MD590caae9596e9d0b8197b2a8bccbdbda9
SHA19f63f4b3e4cb084213b180ceb99b7c63e4c28171
SHA2562516e4ef0dad07775128f80551676a32d04a1be0617a8dfc78360f4f78f0c79b
SHA512d5f83a61efce02458dc42dff98a2e4fcd4e9cfdf0caf404c44167003d6ce2c483affad5a599f1afe07c90f7cecba19124b16b00ebd8504a6a6a7b7b0da653e1c
