Overview
overview
10Static
static
10757e3242f6...b4.exe
windows7-x64
976fe72e0ec...ss.exe
windows7-x64
778d4cf8df6...B3.exe
windows7-x64
778d4cf8df6...59.exe
windows7-x64
778db508226...69.exe
windows7-x64
97965f6adf3...ss.exe
windows7-x64
77B75B33BCF...B5.exe
windows7-x64
17E3903944E...72.exe
windows7-x64
77dd9312307...ca.dll
windows7-x64
37e4c9a7e39...1f.exe
windows7-x64
980eb72d781...B3.exe
windows7-x64
780eb72d781...9A.exe
windows7-x64
7845263c869...c8.exe
windows7-x64
98524224187...8f.exe
windows7-x64
686be3831f5...39.exe
windows7-x64
68791931bac...DA.exe
windows7-x64
78791931bac...69.exe
windows7-x64
787a4f3f9f6...88.exe
windows7-x64
789fb6d7ff2...f6.exe
windows7-x64
98c59148535...21.exe
windows7-x64
98d372fcf8a...e0.exe
windows7-x64
7900.exe
windows7-x64
9911d5905cb...b9.exe
windows7-x64
791d24e0657...eb.zip
windows7-x64
192ac6be4d9...5b.exe
windows7-x64
97512f4617...7c.exe
windows7-x64
1098aadc95c5...e7.exe
windows7-x64
109943256.exe
windows7-x64
109B9517FA15...DF.exe
windows7-x64
79b7eaffe4d...c8.exe
windows7-x64
10a322da0be4...44.exe
windows7-x64
10a42252e674...34.exe
windows7-x64
9Analysis
-
max time kernel
838s -
max time network
839s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 02:43
Behavioral task
behavioral1
Sample
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
1200 seconds
Behavioral task
behavioral2
Sample
76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral3
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral4
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral5
Sample
78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
1200 seconds
Behavioral task
behavioral6
Sample
7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral7
Sample
7B75B33BCF4ECF013B93F84ED98B3FB5.exe
Resource
win7-20240708-en
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral8
Sample
7E3903944EAB7B61B495572BAA60FB72.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
1200 seconds
Behavioral task
behavioral9
Sample
7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
1200 seconds
Behavioral task
behavioral10
Sample
7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
1200 seconds
Behavioral task
behavioral11
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral12
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral13
Sample
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe
Resource
win7-20241023-en
windows7-x64
10 signatures
1200 seconds
Behavioral task
behavioral14
Sample
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
1200 seconds
Behavioral task
behavioral15
Sample
86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
1200 seconds
Behavioral task
behavioral16
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral17
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_TDS=4F84A969.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral18
Sample
87a4f3f9f6dc263378f2f01db5f2c988.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
1200 seconds
Behavioral task
behavioral19
Sample
89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
1200 seconds
Behavioral task
behavioral20
Sample
8c591485357e45a09dad3116496e6f686fa11f445a6bea5ef3cd5ed1ac078821.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
1200 seconds
Behavioral task
behavioral21
Sample
8d372fcf8a97223ebb86cdfe707d3035dfbfd4501c5688cfa82a9a4889e637e0.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
1200 seconds
Behavioral task
behavioral22
Sample
900.exe
Resource
win7-20241023-en
windows7-x64
13 signatures
1200 seconds
Behavioral task
behavioral23
Sample
911d5905cbe1dd462f171b7167cd15b9.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
1200 seconds
Behavioral task
behavioral24
Sample
91d24e06572099ba0aa5c20be6b1021fa48e864913fe3676ed05323e6b68fceb.zip
Resource
win7-20240903-en
windows7-x64
3 signatures
1200 seconds
Behavioral task
behavioral25
Sample
92ac6be4d9215b237d624177ca0543844d0dc8d071660ae4a4cf7c93cc11505b.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
1200 seconds
Behavioral task
behavioral26
Sample
97512f4617019c907cd0f88193039e7c.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
1200 seconds
Behavioral task
behavioral27
Sample
98aadc95c589e064a542802bbf0ef01ef00595c34d195f1a1e6443909846d2e7.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
1200 seconds
Behavioral task
behavioral28
Sample
9943256.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
1200 seconds
Behavioral task
behavioral29
Sample
9B9517FA1515F47A502FE56536236A20BE5BBADF.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
1200 seconds
Behavioral task
behavioral30
Sample
9b7eaffe4dffcbd06445d0b32785cdc8.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
1200 seconds
Behavioral task
behavioral31
Sample
a322da0be4f0be8d85eab815ca708c8452b63f24d0e2d2d6d896a9f9331a6244.exe
Resource
win7-20240903-en
blackmoonbankercredential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealertrojan
windows7-x64
25 signatures
1200 seconds
Behavioral task
behavioral32
Sample
a42252e674a09a0b689e71c88f59969f538a473da647cc4eb5457a5d5e03a234.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
1200 seconds
General
-
Target
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
-
Size
18KB
-
MD5
d8e99fcae9a469c2081e7ff01675c361
-
SHA1
ef7c4358717ec9d04b9adc8e40b1eb928885ebf0
-
SHA256
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4
-
SHA512
cd75242646dde33b7c792e9bf9fe976ce7f2dd1b02c5c97a4cf2f9f80cfae1bd44463fc2b0f9e002d17087358fafa298ca0d4dc4aff17405df95f13099c79b02
-
SSDEEP
384:rd7gYWDhghSmeSQjkCg3St1bVz1LTwbZxssimS8dHDT:6lg/eLjkCwQQFx8SHX
Score
9/10
Malware Config
Signatures
-
Renames multiple (786) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 2 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc process File created C:\Windows\System32\drivers\gmreadme.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Drops startup file 2 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DjrsqvgahLYXnru.exe 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DjrsqvgahLYXnru.exe 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc process File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_script_blocks.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_hash_tables.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_locations.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Command_Syntax.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_type_operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_FAQ.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_troubleshooting.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_Windows_PowerShell_2.0.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Ref.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_data_sections.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_hash_tables.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_jobs.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_arrays.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_Parsing.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_scopes.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_Redirection.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_parameters.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_wildcards.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_Automatic_Variables.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitsTransfer\it-IT\about_BITS_Cmdlets.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_properties.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_pssession_details.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_Language_Keywords.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_providers.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\System32\catroot2\dberr.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_Switch.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_Line_Editing.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_Comment_Based_Help.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_regular_expressions.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_command_precedence.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_join.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_methods.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_properties.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_Switch.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_functions_advanced_methods.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_locations.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_Windows_PowerShell_ISE.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_aliases.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_functions_advanced.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_logical_operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_PSSnapins.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Reserved_Words.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_debuggers.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_requires.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_join.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_PSSnapins.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Session_Configurations.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_prompts.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_functions_advanced_parameters.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_Redirection.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_Variables.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_type_operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions_advanced_methods.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Ref.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_Continue.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Session_Configurations.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Arithmetic_Operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_command_precedence.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_modules.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_Foreach.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_jobs.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_hash_tables.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_CommonParameters.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Drops file in Program Files directory 64 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_hail.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\10.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\corner.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceAmharic.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_few-showers.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-disable.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_h.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_down.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_docked.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mouseout.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_left.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_rest.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\logo.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-2.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mouseover.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent_partly-cloudy.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\RSSFeeds.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_left.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePage.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBrowserUpgrade.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\28.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_s.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\time-span-16.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_windy.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\icon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_h.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_hover.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\bg_sidebar.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Drops file in Windows directory 64 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_profiles.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_parameters.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_execution_policies.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\flower_settings.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\500-19.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Notebook.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_725857cf41f74c3f\settings_divider_left.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\button_MCELogo_mouseover.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\403-9.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp1.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\de\SqlPersistenceProviderSchema.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\Web\Wallpaper\Architecture\img17.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_Core_Commands.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\default.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\ja\DropSqlPersistenceProviderLogic.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2260a04d0daf0ce1\clock.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_Core_Commands.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Assignment_Operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_objects.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d158ae10876efd6d\currency.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Line_Editing.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-cpu_31bf3856ad364e35_6.1.7600.16385_none_4b7bf556f6fe4db9\dial.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\500-17.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_black_moon-waxing-crescent.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-currency_31bf3856ad364e35_6.1.7600.16385_none_679a6ba79b07a3c0\add_over.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\es\SqlPersistenceProviderLogic.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-vignette_31bf3856ad364e35_6.1.7600.16385_none_cc1304de922cc585\1047x576black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\docked_black_few-showers.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_functions_advanced_parameters.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-rssfeedsgadget_31bf3856ad364e35_6.1.7600.16385_none_ab6782291b0ca7be\buttonUp_On.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_815d27dbb889ba17\pause_down.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..ediadisc-style-pets_31bf3856ad364e35_6.1.7600.16385_none_d0d7ee773d711005\Pets_btn-next-over-select.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_Foreach.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\drag.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-13.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_73e472e09a1a05d1\DMR_120.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp1.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\(120DPI)notConnectedStateIcon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\settings_box_divider_left.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..adisc-style-shatter_31bf3856ad364e35_6.1.7600.16385_none_0cd72f8900478c68\NavigationUp_ButtonGraphic.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..tional-chinese-dayi_31bf3856ad364e35_6.1.7600.16385_none_bc71031cff4c1a63\TableTextServiceDaYi.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_functions_advanced_parameters.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\manageSingleRole.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\undocked_gray_foggy.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_netfx35cdf-cdf_sql_files_31bf3856ad364e35_6.1.7600.16385_none_a203944b32daa861\SqlPersistenceProviderSchema.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_try_catch_finally.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..iadisc-style-travel_31bf3856ad364e35_6.1.7600.16385_none_f2a7c66510a5395d\button-highlight.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-landscapes_31bf3856ad364e35_6.1.7600.16385_none_e57abb2f66db71a9\img10.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b60543bd2d988807\RSSFeeds.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2ae1bce6b81c0916\RSSFeeds.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\logo.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-huecycle_31bf3856ad364e35_6.1.7600.16385_none_810df6f57d9f2a73\NavigationRight_ButtonGraphic.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\default.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\square_settings.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_netfx35cdf-cdf_sql_files_31bf3856ad364e35_6.1.7600.16385_none_a203944b32daa861\DropSqlPersistenceProviderSchema.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\Web\Wallpaper\Characters\img20.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_prompts.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\managePermissions.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Stars.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_split.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exepid process 2136 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 2136 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 2136 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 2136 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 2136 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 2136 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 2136 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 2136 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription pid process Token: SeDebugPrivilege 2136 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription pid process target process PID 2136 wrote to memory of 2080 2136 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe WerFault.exe PID 2136 wrote to memory of 2080 2136 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe WerFault.exe PID 2136 wrote to memory of 2080 2136 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe"C:\Users\Admin\AppData\Local\Temp\757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2136 -s 15322⤵PID:2080
-