Overview
overview
10Static
static
10757e3242f6...b4.exe
windows7-x64
976fe72e0ec...ss.exe
windows7-x64
778d4cf8df6...B3.exe
windows7-x64
778d4cf8df6...59.exe
windows7-x64
778db508226...69.exe
windows7-x64
97965f6adf3...ss.exe
windows7-x64
77B75B33BCF...B5.exe
windows7-x64
17E3903944E...72.exe
windows7-x64
77dd9312307...ca.dll
windows7-x64
37e4c9a7e39...1f.exe
windows7-x64
980eb72d781...B3.exe
windows7-x64
780eb72d781...9A.exe
windows7-x64
7845263c869...c8.exe
windows7-x64
98524224187...8f.exe
windows7-x64
686be3831f5...39.exe
windows7-x64
68791931bac...DA.exe
windows7-x64
78791931bac...69.exe
windows7-x64
787a4f3f9f6...88.exe
windows7-x64
789fb6d7ff2...f6.exe
windows7-x64
98c59148535...21.exe
windows7-x64
98d372fcf8a...e0.exe
windows7-x64
7900.exe
windows7-x64
9911d5905cb...b9.exe
windows7-x64
791d24e0657...eb.zip
windows7-x64
992ac6be4d9...5b.exe
windows7-x64
97512f4617...7c.exe
windows7-x64
1098aadc95c5...e7.exe
windows7-x64
109943256.exe
windows7-x64
109B9517FA15...DF.exe
windows7-x64
79b7eaffe4d...c8.exe
windows7-x64
10a322da0be4...44.exe
windows7-x64
10a42252e674...34.exe
windows7-x64
9Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 03:03
Behavioral task
behavioral1
Sample
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral5
Sample
78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral6
Sample
7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral7
Sample
7B75B33BCF4ECF013B93F84ED98B3FB5.exe
Resource
win7-20241010-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral8
Sample
7E3903944EAB7B61B495572BAA60FB72.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral9
Sample
7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral10
Sample
7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral11
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral12
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral13
Sample
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral14
Sample
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe
Resource
win7-20240729-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral15
Sample
86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral16
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
300 seconds
Behavioral task
behavioral17
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_TDS=4F84A969.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
300 seconds
Behavioral task
behavioral18
Sample
87a4f3f9f6dc263378f2f01db5f2c988.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral19
Sample
89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
Resource
win7-20241010-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral20
Sample
8c591485357e45a09dad3116496e6f686fa11f445a6bea5ef3cd5ed1ac078821.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral21
Sample
8d372fcf8a97223ebb86cdfe707d3035dfbfd4501c5688cfa82a9a4889e637e0.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral22
Sample
900.exe
Resource
win7-20240729-en
windows7-x64
13 signatures
300 seconds
Behavioral task
behavioral23
Sample
911d5905cbe1dd462f171b7167cd15b9.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral24
Sample
91d24e06572099ba0aa5c20be6b1021fa48e864913fe3676ed05323e6b68fceb.zip
Resource
win7-20240903-en
windows7-x64
18 signatures
300 seconds
Behavioral task
behavioral25
Sample
92ac6be4d9215b237d624177ca0543844d0dc8d071660ae4a4cf7c93cc11505b.exe
Resource
win7-20241023-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral26
Sample
97512f4617019c907cd0f88193039e7c.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral27
Sample
98aadc95c589e064a542802bbf0ef01ef00595c34d195f1a1e6443909846d2e7.exe
Resource
win7-20241010-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral28
Sample
9943256.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
300 seconds
Behavioral task
behavioral29
Sample
9B9517FA1515F47A502FE56536236A20BE5BBADF.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral30
Sample
9b7eaffe4dffcbd06445d0b32785cdc8.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
300 seconds
Behavioral task
behavioral31
Sample
a322da0be4f0be8d85eab815ca708c8452b63f24d0e2d2d6d896a9f9331a6244.exe
Resource
win7-20241023-en
blackmoonbankercredential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealertrojan
windows7-x64
22 signatures
300 seconds
Behavioral task
behavioral32
Sample
a42252e674a09a0b689e71c88f59969f538a473da647cc4eb5457a5d5e03a234.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
300 seconds
General
-
Target
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
-
Size
18KB
-
MD5
d8e99fcae9a469c2081e7ff01675c361
-
SHA1
ef7c4358717ec9d04b9adc8e40b1eb928885ebf0
-
SHA256
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4
-
SHA512
cd75242646dde33b7c792e9bf9fe976ce7f2dd1b02c5c97a4cf2f9f80cfae1bd44463fc2b0f9e002d17087358fafa298ca0d4dc4aff17405df95f13099c79b02
-
SSDEEP
384:rd7gYWDhghSmeSQjkCg3St1bVz1LTwbZxssimS8dHDT:6lg/eLjkCwQQFx8SHX
Score
9/10
Malware Config
Signatures
-
Renames multiple (780) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 2 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc process File created C:\Windows\System32\drivers\gmreadme.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Drops startup file 2 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DjrsqvgahLYXnru.exe 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DjrsqvgahLYXnru.exe 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc process File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_functions.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_Signing.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_remote_troubleshooting.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_command_precedence.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_WMI_Cmdlets.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_properties.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_format.ps1xml.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_wildcards.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Comment_Based_Help.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Switch.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Arithmetic_Operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_pssession_details.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\System32\catroot2\dberr.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_CommonParameters.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_types.ps1xml.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_While.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_data_sections.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_functions_advanced_parameters.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\es-ES\about_BITS_Cmdlets.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_Special_Characters.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_Reserved_Words.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_script_internationalization.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_execution_policies.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Comment_Based_Help.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_transactions.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_History.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_pipelines.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Windows_PowerShell_2.0.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_split.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_objects.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_wildcards.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote_output.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Windows_PowerShell_ISE.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_remote_jobs.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_PSSnapins.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_Comparison_Operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_debuggers.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions_advanced.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_split.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Comment_Based_Help.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_For.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_Ref.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_join.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_prompts.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_Automatic_Variables.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_command_precedence.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_If.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_FAQ.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_Redirection.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_For.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_methods.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_Path_Syntax.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_Variables.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_escape_characters.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_debuggers.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_pssession_details.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_Session_Configurations.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitsTransfer\en-US\about_BITS_Cmdlets.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_jobs.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_WS-Management_Cmdlets.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_PSSnapins.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Foreach.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Throw.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Assignment_Operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Drops file in Program Files directory 64 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_right.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewTemplate.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\5.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DissolveNoise.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_left.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\1.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_pressed.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\add_up.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_snow.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Green Bubbles.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_up.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\logo.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\ViewHeaderPreview.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\trad.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent_partly-cloudy.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageSmall.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_docked.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginDialogBackground.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)notConnectedStateIcon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-hot.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\5.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\9.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_windy.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square_dot.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsDoNotTrust.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\7.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\11.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\icon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\26.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_h.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\cpu.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\43.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\drag.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\weather.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\0.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Drops file in Windows directory 64 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc process File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\44.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..c-style-performance_31bf3856ad364e35_6.1.7600.16385_none_1d8aecb671a2bda5\redmenu.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_providers.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_Ref.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_CommonParameters.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_Quoting_Rules.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_escape_characters.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_Windows_PowerShell_2.0.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_trap.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\AppConfigHome.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\undocked_black_hail.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\ASPdotNET_logo.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_properties.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlWorkflowInstanceStoreSchemaUpgrade.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-ca-component_31bf3856ad364e35_6.1.7601.17514_none_fae061a2e0ae5019\CA-wp5.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..ediadisc-style-push_31bf3856ad364e35_6.1.7600.16385_none_cc073ae540855a07\NavigationUp_SelectionSubpicture.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\home0.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c9675951dd42e377\slideShow.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\OrangeCircles.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Stars.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_072d3c4f13092ac3\InstallRoles.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Shades of Blue.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\createPermission.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b60543bd2d988807\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\11.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_prompts.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Roses.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Green Bubbles.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\Web\Wallpaper\Scenes\img29.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..eady_eula.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c4a3b307f7533c7e\playReady_eula_oem.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_scripts.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_725857cf41f74c3f\settings_left_hover.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\ManageProviders.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_815d27dbb889ba17\next_rest.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\403-3.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Language_Keywords.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\undocked_black_moon-first-quarter_partly-cloudy.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_netfx35cdf-cdf_sql_files_31bf3856ad364e35_6.1.7600.16385_none_fe222fceeb381997\SqlPersistenceProviderLogic.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Comparison_Operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\modern.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\docked_black_moon-waning-gibbous_partly-cloudy.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallMembership.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallSqlState.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\22.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_script_blocks.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\(120DPI)alertIcon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d4f8a2f961a0e7e4\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_remote_FAQ.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\undocked_gray_few-showers.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\404-13.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_scripts.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\docked_blue_partly-cloudy.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\19.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-6.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..yle-specialoccasion_31bf3856ad364e35_6.1.7600.16385_none_01242a21ddccaf3b\NavigationLeft_SelectionSubpicture.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2b166002b7f51771\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2ae1bce6b81c0916\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..calmediadisc-styles_31bf3856ad364e35_6.1.7600.16385_none_dac1eab162daeb45\4to3Squareframe_VideoInset.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_objects.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Line_Editing.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\undocked_black_thunderstorm.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\SQL\ja\DropSqlPersistenceProviderLogic.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallWebEventSqlProvider.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-flippage_31bf3856ad364e35_6.1.7600.16385_none_0f19716417635239\1047x576black.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exepid process 1720 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 1720 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 1720 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 1720 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 1720 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 1720 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 1720 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 1720 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription pid process Token: SeDebugPrivilege 1720 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription pid process target process PID 1720 wrote to memory of 2956 1720 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe WerFault.exe PID 1720 wrote to memory of 2956 1720 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe WerFault.exe PID 1720 wrote to memory of 2956 1720 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe"C:\Users\Admin\AppData\Local\Temp\757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1720 -s 15122⤵PID:2956
-