Analysis
-
max time kernel
42s -
max time network
138s -
platform
windows7_x64 -
resource
win7 -
submitted
06-07-2020 08:58
Static task
static1
Behavioral task
behavioral1
Sample
decoderma@tutanota.com.exe
Resource
win7
Behavioral task
behavioral2
Sample
decoderma@tutanota.com.exe
Resource
win10
General
-
Target
decoderma@tutanota.com.exe
-
Size
998KB
-
MD5
7bc5183b207888e9c01193fe2f1d0976
-
SHA1
e679f69eb28ab3462cc308143d9d372b40d936d1
-
SHA256
9e3d7b2163b865375d1b14a37c9130c55b9de8a6eb74b54f0d6f1a8b820eceae
-
SHA512
ce38603c3e21a716124bc4cc627f3c983685849625ec2cec5a1391eb904a84dff8681204cc3944c73e19c4398ed37fb8658927ed0f953c037afea98eea989aaf
Malware Config
Signatures
-
Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
-
Drops file in Drivers directory 9 IoCs
Processes:
decoderma@tutanota.com.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\en-US\tcpip.sys.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\drivers\gm.dls decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\bfe.dll.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\qwavedrv.sys.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\pacer.sys.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\scfilter.sys.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\drivers\wimmount.sys decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui decoderma@tutanota.com.exe -
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
decoderma@tutanota.com.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\InvokeConvert.tiff decoderma@tutanota.com.exe -
Drops startup file 1 IoCs
Processes:
decoderma@tutanota.com.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini decoderma@tutanota.com.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
Processes:
decoderma@tutanota.com.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\Pictures\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\assembly\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AJM03J3Y\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Media\Heritage\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Searches\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Globalization\MCT\MCT-GB\Link\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Globalization\MCT\MCT-US\Link\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Media\Delta\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini decoderma@tutanota.com.exe File created C:\$Recycle.Bin\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\Desktop\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Media\Afternoon\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Media\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\Libraries\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Media\Quirky\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini decoderma@tutanota.com.exe File created C:\Program Files\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GVV7BJHB\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Media\Savanna\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Links\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Web\Wallpaper\Architecture\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Cookies\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Media\Characters\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Music\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Fonts\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Media\Festival\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini decoderma@tutanota.com.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
description flow ioc HTTP URL 4 http://www.sfml-dev.org/ip-provider.php HTTP URL 9 http://www.sfml-dev.org/ip-provider.php HTTP URL 11 http://www.sfml-dev.org/ip-provider.php -
Drops file in System32 directory 64 IoCs
Processes:
decoderma@tutanota.com.exedescription ioc process File opened for modification C:\Windows\SysWOW64\NlsLexicons0049.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\sxs.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\en-US\bthprint.inf_loc decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\en-US\net1yx64.inf_loc decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\en-US\WUDFUsbccidDriver.inf_loc decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netl1c64.inf_amd64_neutral_30b0b06f47cab8cf\L1C62x64.sys decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep00b.inf_amd64_neutral_2e6b718b2b177506\Amd64\EP0NCA8M.CMB decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep00c.inf_amd64_neutral_f0d9ddf52f04765c\Amd64\EP0NOE8T.DXT decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc5200t.gpd decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SNMP-Package~31bf3856ad364e35~amd64~en-US~6.1.7600.16385.cat decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\en-US\vsmraid.inf_loc decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\avmx64c.inf_amd64_neutral_8ebb15bf548db022\avmx64c.inf decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnky004.inf_amd64_neutral_5db759db19acd3ae\Amd64\KYW7AUT4.INI decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\en-US\sppcc.dll.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\rastls.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\faxca003.inf_amd64_neutral_5b8c7c1dda79bef4\faxca003.inf decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netrtx64.inf_amd64_neutral_410e89ed86071c9b\netrtx64.inf decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc7200t.xml decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hpfigw73.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_neutral_3500779911f7f3ca\wceisvista.PNF decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\en-US\NetworkMap.dll.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\en-US\sccls.dll.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\en-US\Utilman.exe.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\migwiz\dlmanifests\PeerToPeerBase-DL.man decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmbr007.inf_amd64_neutral_91d259640bad7d26\BrSerIb.sys decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPC3050F.GPD decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa430t.xml decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\migration\netiomig.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\migwiz\dlmanifests\MediaServer-Migration-DL.man decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\NlsLexicons001d.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep00g.inf_amd64_neutral_2926840e245f88f6\Amd64\EP0NOE8R.DXT decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\dmcompos.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\inseng.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_neutral_d9eee378245b3b8b\RTL8187B.sys decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnle004.inf_amd64_neutral_beb9bf23b7202bff\Amd64\LN1342E3.PPD decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnrc007.inf_amd64_neutral_2df575afa0f7d35f\Amd64\RAF21753.PPD decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\CNFRAI.ICC decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Win8IP-Microsoft-Windows-DownlevelApisets-Base-WinIP-Package~31bf3856ad364e35~amd64~sr-LATN-CS~7.1.7601.16492.cat decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\Amd64\EP7UIP00.DLL decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\KBDKAZ.DLL decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\qdv.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\WiaExtensionHost64.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00y.inf_amd64_neutral_64560c72e81f6ad7\Amd64\CNBJPR18.ICM decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnrc006.inf_amd64_neutral_7e12a60cc98d3f89\Amd64\RIA1616.GPD decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\en-US\dinput.dll.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\en-US\msfeedsbs.dll.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\en-US\TSWorkspace.dll.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\spp\tokens\ppdlic\provsvc-license-ppdlic.xrm-ms decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpbsnewm.gpd decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wiabr005.inf_amd64_neutral_e14a0514f37611d8\wiabr005.inf decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\slmgr.vbs decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_neutral_8887242a56ee027e\dc21x4vm.sys decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNBJOP8F.DLL decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\Amd64\CNBBR310.DLL decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\CNB7UMAA.ICM decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hpfvuw73.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnle003.inf_amd64_neutral_c61883abf66ddb39\Amd64\LR1506.GPD decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\Amd64\NR40006.GPD decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-CertificateServices-MSCEP-DL.man decoderma@tutanota.com.exe File opened for modification C:\Windows\SysWOW64\timedate.cpl decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNB_0302.GPD decoderma@tutanota.com.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnky007.inf_amd64_neutral_e637699044f367f3\Amd64\kyw7sr03.dll decoderma@tutanota.com.exe -
Drops file in Program Files directory 64 IoCs
Processes:
decoderma@tutanota.com.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_spellcheck.gif decoderma@tutanota.com.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File created C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0234131.WMF.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File created C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Ushuaia decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jre7\bin\libxml2.dll.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Toronto decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Casual.gif decoderma@tutanota.com.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider_left.png decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msdfmap.dll decoderma@tutanota.com.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\zh-CN.pak.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11 decoderma@tutanota.com.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1XTOR.DLL.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File created C:\Program Files\Java\jre7\lib\zi\America\Montreal.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0290548.WMF.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0199283.WMF decoderma@tutanota.com.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_h.png decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\lv.pak.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0292278.WMF.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02134_.GIF.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File created C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Hardcover.xml.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105588.WMF.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00443_.WMF decoderma@tutanota.com.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dts_plugin.dll decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\Windows Defender\en-US\MpEvMsg.dll.mui decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099160.JPG decoderma@tutanota.com.exe File opened for modification C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui decoderma@tutanota.com.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0089992.WMF.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0182898.WMF decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Earthy.css decoderma@tutanota.com.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo decoderma@tutanota.com.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll decoderma@tutanota.com.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\SLATE.INF decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Berlin decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02068_.WMF decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_over.png decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14768_.GIF decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.stdformat.dll decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY00795_.WMF.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml decoderma@tutanota.com.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll decoderma@tutanota.com.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0157763.WMF.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02567J.JPG.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02228_.WMF.[decoderma@tutanota.com][ID-H8Z4B30C7FQUOE2].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL decoderma@tutanota.com.exe -
Drops file in Windows directory 64 IoCs
Processes:
decoderma@tutanota.com.exedescription ioc process File opened for modification C:\Windows\servicing\Packages\Win8IP-Microsoft-Windows-Multimedia-Package~31bf3856ad364e35~amd64~en-GB~7.1.7601.16492.cat decoderma@tutanota.com.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Design\3.5.0.0__b77a5c561934e089\System.Data.Entity.Design.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Linq.Queryable.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\Cursors\size4_im.cur decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.Powershell.Commands.Utility.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\ehome\ehsched.exe decoderma@tutanota.com.exe File opened for modification C:\Windows\Fonts\seriffe.fon decoderma@tutanota.com.exe File opened for modification C:\Windows\Fonts\app857.fon decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\ph3xibc4.PNF decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\tpm.inf decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\home2.aspx.resx decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\en-US\ServiceModelInstallRC.dll.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\dcbadb02f6000b436f1cb0fb736df3ee\System.Drawing.ni.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\prnok002.inf decoderma@tutanota.com.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-ServicingBaseline-Ultimate-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.mum decoderma@tutanota.com.exe File opened for modification C:\Windows\Boot\PCAT\ko-KR\bootmgr.exe.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\ph3xibc1.PNF decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.Build.Tasks.v3.5.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\PolicyDefinitions\en-US\DFS.adml decoderma@tutanota.com.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Comp46f2b404#\0a6fed4a3d60bba766a643e4bc2e5968\System.ComponentModel.DataAnnotations.ni.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\Windows6.1-KB2999226-x64.cab decoderma@tutanota.com.exe File opened for modification C:\Windows\en-US\fveupdate.exe.mui decoderma@tutanota.com.exe File opened for modification C:\Windows\Fonts\h8514fix.fon decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\_TransactionBridgePerfCounters.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package-MiniLP~31bf3856ad364e35~amd64~el-GR~7.1.7601.16492.cat decoderma@tutanota.com.exe File opened for modification C:\Windows\servicing\Packages\Package_for_KB2809215_SP1~31bf3856ad364e35~amd64~~6.1.1.1.mum decoderma@tutanota.com.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data.SqlXml\3abef8eeb03dddf15f0ee7406c517b6e\System.Data.SqlXml.ni.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\mdmracal.inf decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\lsi_sas.PNF decoderma@tutanota.com.exe File opened for modification C:\Windows\Installer\fbc8.msi decoderma@tutanota.com.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package~31bf3856ad364e35~amd64~it-IT~7.1.7601.16492.cat decoderma@tutanota.com.exe File opened for modification C:\Windows\Cursors\aero_busy_xl.ani decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\display.inf decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\prnlx008.inf decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\prnca00x.inf decoderma@tutanota.com.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\e27ae693b6e71bb689ec66761a65901f\System.ServiceModel.ni.dll.aux decoderma@tutanota.com.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.AddIn\a7bc3b42b60c8eaa28b5b62900c9027f\System.AddIn.ni.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\Fonts\Candarab.ttf decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\image.PNF decoderma@tutanota.com.exe File opened for modification C:\Windows\servicing\Packages\Win8IP-Microsoft-Windows-DownlevelApisets-Base-WinIP-Package~31bf3856ad364e35~amd64~hr-HR~7.1.7601.16492.cat decoderma@tutanota.com.exe File opened for modification C:\Windows\servicing\Packages\Win8IP-Microsoft-Windows-Graphics-Package~31bf3856ad364e35~amd64~nl-NL~7.1.7601.16492.mum decoderma@tutanota.com.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.6.0.Microsoft.MediaCenter\6.1.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.MediaCenter.config decoderma@tutanota.com.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationUI\d7c71f43e6d6e92221717345e6156044\PresentationUI.ni.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\servicing\Packages\Win8IP-Microsoft-Windows-Multimedia-Package~31bf3856ad364e35~amd64~bg-BG~7.1.7601.16492.mum decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\CreateAppSetting.aspx.resx decoderma@tutanota.com.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-ShareMedia-ControlPanel-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.cat decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\nettun.PNF decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\setupapi.ev3 decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.DurableInstancing.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\Prefetch\TASKHOST.EXE-7238F31D.pf decoderma@tutanota.com.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dire5d62f0a2#\74935b58bfe4054a47e71f128e498aba\System.DirectoryServices.Protocols.ni.dll.aux decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\netb57va.PNF decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorlib.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\wpfgfx_v0300.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif decoderma@tutanota.com.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-MobilePC-Client-Sensors-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.cat decoderma@tutanota.com.exe File opened for modification C:\Windows\Help\mui\0409\taskscheduler.CHM decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\aspnet_state\000C\aspnet_state_perf.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\_TransactionBridgePerfCounters.ini decoderma@tutanota.com.exe -
NTFS ADS 43 IoCs
Processes:
decoderma@tutanota.com.exedescription ioc process File opened for modification C:\ProgramData\Documents\Updater6\ꞔ瘘"쀀\ꞔ瘘:쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Documents\Updater6\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Templates\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\Default\Application Data\Roaming\ꞔ瘘"쀀勐 儈 ꨚ瘘\ꞔ瘘:쀀ᨀ᧨ꨚ瘘\ꞔ瘘:쀀ᦠᦈꨚ瘘 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Application Data\Color\"쀀糘糘ꨚ瘘\:쀀䭨䭨ꨚ瘘\:쀀䮈䮈ꨚ瘘\3쀀䮨䮨ꨚ瘘\3쀀䬨䬨ꨚ瘘\3쀀䰨䰨ꨚ瘘\3쀀䱈䱈ꨚ瘘\3쀀䱨䱨ꨚ瘘\3쀀䲈䲈ꨚ瘘\3쀀䲨䲨ꨚ瘘\3쀀䳈䳈ꨚ瘘\Ő䳨żꨚ瘘 decoderma@tutanota.com.exe File opened for modification C:\Users\Default\Cookies\Roaming\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\System Volume Information\f840bc82-aff2-11ea-839f-f21450b4f854\ꞔ瘘"쀀\ꞔ瘘:쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\History\Chrome\ꞔ瘘"쀀\ꞔ瘘:쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Start Menu\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\ꞔ瘘"쀀\ꞔ瘘:쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Favorites\Updater6\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Start Menu\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\ꞔ瘘"쀀엀ɼ얐ɼꨚ瘘\ꞔ瘘:쀀쮈ɼ쭰ɼꨚ瘘\ꞔ瘘:쀀쮨ɼ쮐ɼꨚ瘘 decoderma@tutanota.com.exe File opened for modification C:\Users\Default\Cookies\Roaming\ꞔ瘘"쀀勐 儠 ꨚ瘘\ꞔ瘘:쀀ᨀ᧨ꨚ瘘\ꞔ瘘:쀀ᦠᦈꨚ瘘 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Desktop\Updater6\ꞔ瘘"쀀\ꞔ瘘:쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Templates\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\ꞔ瘘"쀀\ꞔ瘘:쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Temporary Internet Files\WPDNSE\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Desktop\Updater6\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Documents\Updater6\ꞔ瘘"쀀엀ɼ씀ɼꨚ瘘\ꞔ瘘:쀀ᧀᦨꨚ瘘\ꞔ瘘:쀀ᦠᦈꨚ瘘 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Templates\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Application Data\Roaming\ꞔ瘘"쀀匀 儈 ꨚ瘘\ꞔ瘘:쀀㙐㘸ꨚ瘘\ꞔ瘘:쀀㘰㘘ꨚ瘘 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Templates\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\ꞔ瘘"쀀엀ɼ얨ɼꨚ瘘\ꞔ瘘:쀀쮈ɼ쭰ɼꨚ瘘\ꞔ瘘:쀀쮨ɼ쮐ɼꨚ瘘 decoderma@tutanota.com.exe File opened for modification C:\Documents and Settings\S-1-5-21-1131729243-447456001-3632642222-1000\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Favorites\Updater6\ꞔ瘘"쀀\ꞔ瘘:쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\System Volume Information\f840bc82-aff2-11ea-839f-f21450b4f854\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Start Menu\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\"쀀槀槀ꨚ瘘\:쀀㙸㙸ꨚ瘘\:쀀㚸㚸ꨚ瘘\3쀀㘸㘸ꨚ瘘\3쀀㛘㛘ꨚ瘘\3쀀㛸㛸ꨚ瘘\3쀀㜘㜘ꨚ瘘\3쀀㜸㜸ꨚ瘘\3쀀㝘㝘ꨚ瘘\3쀀㝸㝸ꨚ瘘\3쀀㞘㞘ꨚ瘘\3쀀㞸㞸ꨚ瘘\3쀀넠넠ꨚ瘘\3쀀녀녀ꨚ瘘\耀\3쀀놀놀ꨚ瘘\3쀀놠Őꨚ瘘ż decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Desktop\Updater6\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Favorites\Updater6\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Start Menu\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Start Menu\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Documents and Settings\S-1-5-21-1131729243-447456001-3632642222-1000\ꞔ瘘"쀀㬈㨘ꨚ瘘\ꞔ瘘:쀀ꨚ瘘 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Application Data\Updater6\ꞔ瘘"쀀\ꞔ瘘:쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Application Data\Color\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Application Data\Roaming\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Desktop\Updater6\ꞔ瘘"쀀엀ɼ쓨ɼꨚ瘘\ꞔ瘘:쀀ᧀᦨꨚ瘘\ꞔ瘘:쀀ᦠᦈꨚ瘘 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Application Data\Color\ꞔ瘘"쀀\ꞔ瘘:쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Temporary Internet Files\WPDNSE\ꞔ瘘"쀀\ꞔ瘘:쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\System Volume Information\f840bc82-aff2-11ea-839f-f21450b4f854\ꞔ瘘"쀀㬈㫀ꨚ瘘\ꞔ瘘:쀀뾸뾠ꨚ瘘 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Application Data\Updater6\ꞔ瘘"쀀엀ɼ쓐ɼꨚ瘘\ꞔ瘘:쀀ᧀᦨꨚ瘘\ꞔ瘘:쀀ᦠᦈꨚ瘘 decoderma@tutanota.com.exe File opened for modification C:\Users\Default\Application Data\Roaming\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Favorites\Updater6\ꞔ瘘"쀀엀ɼ씘ɼꨚ瘘\ꞔ瘘:쀀ᧀᦨꨚ瘘\ꞔ瘘:쀀ᦠᦈꨚ瘘 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\History\Chrome\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Application Data\Updater6\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Application Data\Updater6\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Documents\Updater6\ꞔ瘘"쀀\ꞔ瘘:쀀 decoderma@tutanota.com.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
decoderma@tutanota.com.exepid process 1072 decoderma@tutanota.com.exe 1072 decoderma@tutanota.com.exe 1072 decoderma@tutanota.com.exe 1072 decoderma@tutanota.com.exe 1072 decoderma@tutanota.com.exe 1072 decoderma@tutanota.com.exe 1072 decoderma@tutanota.com.exe 1072 decoderma@tutanota.com.exe 1072 decoderma@tutanota.com.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
decoderma@tutanota.com.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.exedescription pid process target process PID 1072 wrote to memory of 1308 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1308 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1308 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1308 1072 decoderma@tutanota.com.exe cmd.exe PID 1308 wrote to memory of 1432 1308 cmd.exe net.exe PID 1308 wrote to memory of 1432 1308 cmd.exe net.exe PID 1308 wrote to memory of 1432 1308 cmd.exe net.exe PID 1308 wrote to memory of 1432 1308 cmd.exe net.exe PID 1432 wrote to memory of 1440 1432 net.exe net1.exe PID 1432 wrote to memory of 1440 1432 net.exe net1.exe PID 1432 wrote to memory of 1440 1432 net.exe net1.exe PID 1432 wrote to memory of 1440 1432 net.exe net1.exe PID 1072 wrote to memory of 1496 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1496 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1496 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1496 1072 decoderma@tutanota.com.exe cmd.exe PID 1496 wrote to memory of 296 1496 cmd.exe net.exe PID 1496 wrote to memory of 296 1496 cmd.exe net.exe PID 1496 wrote to memory of 296 1496 cmd.exe net.exe PID 1496 wrote to memory of 296 1496 cmd.exe net.exe PID 296 wrote to memory of 644 296 net.exe net1.exe PID 296 wrote to memory of 644 296 net.exe net1.exe PID 296 wrote to memory of 644 296 net.exe net1.exe PID 296 wrote to memory of 644 296 net.exe net1.exe PID 1072 wrote to memory of 788 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 788 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 788 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 788 1072 decoderma@tutanota.com.exe cmd.exe PID 788 wrote to memory of 1048 788 cmd.exe net.exe PID 788 wrote to memory of 1048 788 cmd.exe net.exe PID 788 wrote to memory of 1048 788 cmd.exe net.exe PID 788 wrote to memory of 1048 788 cmd.exe net.exe PID 1048 wrote to memory of 1112 1048 net.exe net1.exe PID 1048 wrote to memory of 1112 1048 net.exe net1.exe PID 1048 wrote to memory of 1112 1048 net.exe net1.exe PID 1048 wrote to memory of 1112 1048 net.exe net1.exe PID 1072 wrote to memory of 1096 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1096 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1096 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1096 1072 decoderma@tutanota.com.exe cmd.exe PID 1096 wrote to memory of 1536 1096 cmd.exe net.exe PID 1096 wrote to memory of 1536 1096 cmd.exe net.exe PID 1096 wrote to memory of 1536 1096 cmd.exe net.exe PID 1096 wrote to memory of 1536 1096 cmd.exe net.exe PID 1536 wrote to memory of 1512 1536 net.exe net1.exe PID 1536 wrote to memory of 1512 1536 net.exe net1.exe PID 1536 wrote to memory of 1512 1536 net.exe net1.exe PID 1536 wrote to memory of 1512 1536 net.exe net1.exe PID 1072 wrote to memory of 1720 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1720 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1720 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1720 1072 decoderma@tutanota.com.exe cmd.exe PID 1720 wrote to memory of 1392 1720 cmd.exe net.exe PID 1720 wrote to memory of 1392 1720 cmd.exe net.exe PID 1720 wrote to memory of 1392 1720 cmd.exe net.exe PID 1720 wrote to memory of 1392 1720 cmd.exe net.exe PID 1392 wrote to memory of 1260 1392 net.exe net1.exe PID 1392 wrote to memory of 1260 1392 net.exe net1.exe PID 1392 wrote to memory of 1260 1392 net.exe net1.exe PID 1392 wrote to memory of 1260 1392 net.exe net1.exe PID 1072 wrote to memory of 1804 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1804 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1804 1072 decoderma@tutanota.com.exe cmd.exe PID 1072 wrote to memory of 1804 1072 decoderma@tutanota.com.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\decoderma@tutanota.com.exe"C:\Users\Admin\AppData\Local\Temp\decoderma@tutanota.com.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLWriter2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLBrowser2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$CONTOSO13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$CONTOSO14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSDTC2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSDTC3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSDTC4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop vds2⤵
-
C:\Windows\SysWOW64\net.exenet stop vds3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vds4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/296-4-0x0000000000000000-mapping.dmp
-
memory/644-5-0x0000000000000000-mapping.dmp
-
memory/788-6-0x0000000000000000-mapping.dmp
-
memory/884-30-0x0000000000000000-mapping.dmp
-
memory/1040-27-0x0000000000000000-mapping.dmp
-
memory/1048-7-0x0000000000000000-mapping.dmp
-
memory/1072-33-0x00000000013B0000-0x00000000013C1000-memory.dmpFilesize
68KB
-
memory/1072-31-0x00000000013B0000-0x00000000013C1000-memory.dmpFilesize
68KB
-
memory/1072-32-0x00000000017C0000-0x00000000017D1000-memory.dmpFilesize
68KB
-
memory/1096-9-0x0000000000000000-mapping.dmp
-
memory/1112-8-0x0000000000000000-mapping.dmp
-
memory/1260-14-0x0000000000000000-mapping.dmp
-
memory/1308-0-0x0000000000000000-mapping.dmp
-
memory/1392-13-0x0000000000000000-mapping.dmp
-
memory/1432-1-0x0000000000000000-mapping.dmp
-
memory/1440-2-0x0000000000000000-mapping.dmp
-
memory/1496-3-0x0000000000000000-mapping.dmp
-
memory/1500-29-0x0000000000000000-mapping.dmp
-
memory/1512-11-0x0000000000000000-mapping.dmp
-
memory/1536-10-0x0000000000000000-mapping.dmp
-
memory/1576-19-0x0000000000000000-mapping.dmp
-
memory/1636-20-0x0000000000000000-mapping.dmp
-
memory/1648-17-0x0000000000000000-mapping.dmp
-
memory/1652-18-0x0000000000000000-mapping.dmp
-
memory/1720-12-0x0000000000000000-mapping.dmp
-
memory/1784-16-0x0000000000000000-mapping.dmp
-
memory/1804-15-0x0000000000000000-mapping.dmp
-
memory/1860-22-0x0000000000000000-mapping.dmp
-
memory/1904-21-0x0000000000000000-mapping.dmp
-
memory/1932-25-0x0000000000000000-mapping.dmp
-
memory/1940-24-0x0000000000000000-mapping.dmp
-
memory/1964-23-0x0000000000000000-mapping.dmp
-
memory/1988-28-0x0000000000000000-mapping.dmp
-
memory/1996-26-0x0000000000000000-mapping.dmp