Overview
overview
10Static
static
10757e3242f6...b4.exe
windows7-x64
9757e3242f6...b4.exe
windows10-2004-x64
976fe72e0ec...ss.exe
windows7-x64
776fe72e0ec...ss.exe
windows10-2004-x64
1078d4cf8df6...B3.exe
windows7-x64
778d4cf8df6...B3.exe
windows10-2004-x64
1078d4cf8df6...59.exe
windows7-x64
778d4cf8df6...59.exe
windows10-2004-x64
378db508226...69.exe
windows7-x64
978db508226...69.exe
windows10-2004-x64
97965f6adf3...ss.exe
windows7-x64
77965f6adf3...ss.exe
windows10-2004-x64
77B75B33BCF...B5.exe
windows7-x64
17B75B33BCF...B5.exe
windows10-2004-x64
17E3903944E...72.exe
windows7-x64
77E3903944E...72.exe
windows10-2004-x64
57dd9312307...ca.dll
windows7-x64
37dd9312307...ca.dll
windows10-2004-x64
37e4c9a7e39...1f.exe
windows7-x64
97e4c9a7e39...1f.exe
windows10-2004-x64
780eb72d781...B3.exe
windows7-x64
780eb72d781...B3.exe
windows10-2004-x64
1080eb72d781...9A.exe
windows7-x64
780eb72d781...9A.exe
windows10-2004-x64
3845263c869...c8.exe
windows7-x64
9845263c869...c8.exe
windows10-2004-x64
98524224187...8f.exe
windows7-x64
68524224187...8f.exe
windows10-2004-x64
686be3831f5...39.exe
windows7-x64
686be3831f5...39.exe
windows10-2004-x64
68791931bac...DA.exe
windows7-x64
78791931bac...DA.exe
windows10-2004-x64
10Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 09:21
Behavioral task
behavioral1
Sample
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral10
Sample
78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral11
Sample
7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
7B75B33BCF4ECF013B93F84ED98B3FB5.exe
Resource
win7-20240729-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
7B75B33BCF4ECF013B93F84ED98B3FB5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
7E3903944EAB7B61B495572BAA60FB72.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
7E3903944EAB7B61B495572BAA60FB72.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe
Resource
win7-20241010-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral20
Sample
7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral21
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral23
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral26
Sample
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral27
Sample
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral28
Sample
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral29
Sample
86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral32
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
-
Size
18KB
-
MD5
d8e99fcae9a469c2081e7ff01675c361
-
SHA1
ef7c4358717ec9d04b9adc8e40b1eb928885ebf0
-
SHA256
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4
-
SHA512
cd75242646dde33b7c792e9bf9fe976ce7f2dd1b02c5c97a4cf2f9f80cfae1bd44463fc2b0f9e002d17087358fafa298ca0d4dc4aff17405df95f13099c79b02
-
SSDEEP
384:rd7gYWDhghSmeSQjkCg3St1bVz1LTwbZxssimS8dHDT:6lg/eLjkCwQQFx8SHX
Score
9/10
Malware Config
Signatures
-
Renames multiple (786) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 2 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc Process File created C:\Windows\System32\drivers\gmreadme.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Drops startup file 2 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DjrsqvgahLYXnru.exe 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DjrsqvgahLYXnru.exe 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc Process File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_execution_policies.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_trap.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_While.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_Foreach.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_execution_policies.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_format.ps1xml.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_providers.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_Special_Characters.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Line_Editing.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_data_sections.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_Windows_PowerShell_ISE.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_join.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Reserved_Words.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_split.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_remote_jobs.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Windows_PowerShell_2.0.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions_advanced_methods.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_While.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_WMI_Cmdlets.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_objects.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_trap.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_transactions.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions_cmdletbindingattribute.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_try_catch_finally.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_script_internationalization.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_Quoting_Rules.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Session_Configurations.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_locations.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_script_blocks.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_Signing.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_logical_operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Session_Configurations.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_command_precedence.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_functions_cmdletbindingattribute.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_While.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\it-IT\erofflps.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_If.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_pipelines.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_try_catch_finally.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_functions.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_job_details.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_requires.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_environment_variables.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_trap.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Assignment_Operators.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_pssessions.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_WMI_Cmdlets.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ja-JP\about_BITS_Cmdlets.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_History.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_Line_Editing.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_debuggers.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_troubleshooting.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_parameters.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_functions_cmdletbindingattribute.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_If.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_transactions.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\fr-FR\about_BITS_Cmdlets.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_Switch.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_Language_Keywords.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_remote_jobs.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Drops file in Program Files directory 64 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\info.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_up.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\9.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsFormTemplate.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHigh.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\0.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_bottom.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-2.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImages.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous_partly-cloudy.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-new.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsColorChart.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_s.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_pressed.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_settings.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_down.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_left.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_h.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-4.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\month.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierUpArrow.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_rest.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImages.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIcons.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_settings.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_settings.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\6.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_m.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_right.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_sml.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_right.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\logo.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\17.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Drops file in Windows directory 64 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription ioc Process File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_environment_variables.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\401.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_Session_Configurations.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\Gadget_Star_Empty.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\12.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\alertIcon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_requires.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\SQL\ja\DropSqlPersistenceProviderSchema.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_job_details.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\it\Tracking_Logic.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..adisc-style-babyboy_31bf3856ad364e35_6.1.7600.16385_none_f13596916b261f67\navSubpicture.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-landscapes_31bf3856ad364e35_6.1.7600.16385_none_e57abb2f66db71a9\img10.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_it-it_13dfc4b03a7d762c\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a5f3b7a6a481da29\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_functions.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_functions_advanced_methods.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_Switch.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_functions.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..iadisc-style-travel_31bf3856ad364e35_6.1.7600.16385_none_f2a7c66510a5395d\passportcover.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_providers.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\36.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\6.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..iadisc-style-travel_31bf3856ad364e35_6.1.7600.16385_none_f2a7c66510a5395d\content-background.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_If.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp1.jpg 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\UninstallWebEventSqlProvider.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\WebAdminHelp.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_cd9932e5aaee1f78\RSSFeeds.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_execution_policies.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_wildcards.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallWebEventSqlProvider.sql 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_pssessions.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\403-11.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-15.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Redirection.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ThirdPartyNotices.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c1ab456ba37238a2\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d4f8a2f961a0e7e4\settings.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\undocked_black_moon-full.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..calmediadisc-styles_31bf3856ad364e35_6.1.7600.16385_none_dac1eab162daeb45\4to3Squareframe_SelectionSubpicture.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_types.ps1xml.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_prompts.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-rssfeedsgadget_31bf3856ad364e35_6.1.7600.16385_none_07861dacd36a18f4\icon.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_debuggers.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Switch.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_Command_Syntax.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\docked_black_moon-new_partly-cloudy.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-calendar_31bf3856ad364e35_6.1.7600.16385_none_6a1946701e0df451\bPrev-disable.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8700586a70797a4c\RSSFeeds.html 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_725857cf41f74c3f\settings_corner_top_right.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..inboxgames-shanghai_31bf3856ad364e35_6.1.7600.16385_none_1c98ed5d08db04ce\MahjongMCE.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft.backgroun..nt.module.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e0e7b1171f7308f0\about_BITS_Cmdlets.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\info.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\manageUsers.aspx 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\23.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\404-11.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..adisc-style-babyboy_31bf3856ad364e35_6.1.7600.16385_none_f13596916b261f67\nav_uparrow.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..yle-specialoccasion_31bf3856ad364e35_6.1.7600.16385_none_01242a21ddccaf3b\mainscroll.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_For.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\500-19.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-7.htm 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_try_catch_finally.help.txt 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_ce76f352fa54bd75\6.png 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exepid Process 1920 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 1920 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 1920 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 1920 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 1920 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 1920 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 1920 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 1920 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription pid Process Token: SeDebugPrivilege 1920 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exedescription pid Process procid_target PID 1920 wrote to memory of 2240 1920 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 34 PID 1920 wrote to memory of 2240 1920 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 34 PID 1920 wrote to memory of 2240 1920 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe"C:\Users\Admin\AppData\Local\Temp\757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1920 -s 14842⤵PID:2240
-