|
4/5
|
Network
|
Modifies network configuration
|
-
|
|
-
Modifies the host.conf file, probably to redirect network traffic.
|
|
4/5
|
File System
|
Modifies content of user files
|
Ransomware
|
|
-
Modifies the content of multiple user files. This is an indicator for an encryption attempt.
|
|
4/5
|
File System
|
Renames user files
|
Ransomware
|
|
-
Renames multiple user files. This is an indicator for an encryption attempt.
|
|
4/5
|
File System
|
Known malicious file
|
Trojan
|
|
-
File "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\update.exe" is a known malicious file.
|
|
3/5
|
Browser
|
Reads data related to browser cache
|
-
|
|
-
Reads Internet Explorer cache file "C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini".
|
|
-
Reads Internet Explorer cache file "C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat".
|
|
-
Reads Internet Explorer cache file "C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MM5O9XQS\desktop.ini".
|
|
-
Reads Internet Explorer cache file "C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PMMR5K9K\desktop.ini".
|
|
-
Reads Internet Explorer cache file "C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RIJUQL1C\desktop.ini".
|
|
-
Reads Internet Explorer cache file "C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X9OHK109\desktop.ini".
|
|
-
Reads Internet Explorer cache file "C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini".
|
|
3/5
|
Browser
|
Reads data related to browser cookies
|
-
|
|
-
Reads Cookies for "Microsoft Internet Explorer".
|
|
-
Accesses Cookies for "Microsoft Internet Explorer".
|
|
2/5
|
Browser
|
Reads data related to browsing history
|
-
|
|
-
Reads the browsing history for "Microsoft Internet Explorer".
|
|
2/5
|
Network
|
Associated with known malicious/suspicious URLs
|
-
|
|
-
URL "http://paulmcnagets.ru/003/get.php?pid=33E9AA5ADDB65D39A5923495F06BCF33" is known as malicious URL.
|
|
-
URL "http://jordan9908.ru/1.exe" is known as malicious URL.
|
|
-
URL "http://jordan9908.ru/2.exe" is known as malicious URL.
|
|
-
URL "http://jordan9908.ru/updatewin.exe" is known as malicious URL.
|
|
-
URL "http://jordan9908.ru/4.exe" is known as malicious URL.
|
|
1/5
|
Anti Analysis
|
Resolves APIs dynamically
|
-
|
|
-
Resolves an unusually high number of APIs.
|
|
1/5
|
Persistence
|
Installs system startup script or application
|
-
|
|
-
Adds ""C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\544c4f6e-08e8-406f-ae98-d88505d8a2e3\update.exe" --AutoStart" to Windows startup via registry.
|
|
-
Adds "c:\users\all users\microsoft\windows\start menu\programs\startup\desktop.ini" to Windows startup folder.
|
|
-
Adds "c:\users\all users\microsoft\windows\start menu\programs\startup\desktop.ini.infowait" to Windows startup folder.
|
|
-
Adds "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini" to Windows startup folder.
|
|
-
Adds "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.infowait" to Windows startup folder.
|
|
1/5
|
Process
|
Creates process with hidden window
|
-
|
|
-
The process "icacls "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\544c4f6e-08e8-406f-ae98-d88505d8a2e3" /deny *S-1-1-0:(OI)(CI)(DE,DC)" starts with hidden window.
|
|
-
The process ""C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\update.exe" --ForNetRes 5sQa7p3KFH0h1EIQpNMDhhbQdqopHt59HIaPvsLC LsCOYLRYMkqjvfiCCakqofPJhgWeL5nBT09BhA40 IsNotAutoStart IsNotTask" starts with hidden window.
|
|
-
The process ""C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\update.exe" --Service 2308 5sQa7p3KFH0h1EIQpNMDhhbQdqopHt59HIaPvsLC LsCOYLRYMkqjvfiCCakqofPJhgWeL5nBT09BhA40" starts with hidden window.
|
|
-
The process "powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned" starts with hidden window.
|
|
-
The process ""C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\544c4f6e-08e8-406f-ae98-d88505d8a2e3\update.exe" --ForNetRes 5sQa7p3KFH0h1EIQpNMDhhbQdqopHt59HIaPvsLC LsCOYLRYMkqjvfiCCakqofPJhgWeL5nBT09BhA40 IsAutoStart IsNotTask" starts with hidden window.
|
|
-
The process ""C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\544c4f6e-08e8-406f-ae98-d88505d8a2e3\update.exe" --Service 1676 5sQa7p3KFH0h1EIQpNMDhhbQdqopHt59HIaPvsLC LsCOYLRYMkqjvfiCCakqofPJhgWeL5nBT09BhA40" starts with hidden window.
|
|
-
The process ""C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\544c4f6e-08e8-406f-ae98-d88505d8a2e3\update.exe" --Service 2040 5sQa7p3KFH0h1EIQpNMDhhbQdqopHt59HIaPvsLC LsCOYLRYMkqjvfiCCakqofPJhgWeL5nBT09BhA40" starts with hidden window.
|
|
1/5
|
Process
|
Creates system object
|
-
|
|
-
Creates mutex with name "{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}".
|
|
-
Creates mutex with name "{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}".
|
|
1/5
|
File System
|
Modifies operating system directory
|
-
|
|
-
Modifies file "C:\Windows\System32\drivers\etc\hosts" in the OS directory.
|
|
1/5
|
Masquerade
|
Changes folder appearance
|
Riskware
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\contacts" has a changed appearance.
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\documents" has a changed appearance.
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\documents\my shapes" has a changed appearance.
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\downloads" has a changed appearance.
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\favorites" has a changed appearance.
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\favorites\links" has a changed appearance.
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\links" has a changed appearance.
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\music" has a changed appearance.
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\pictures" has a changed appearance.
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\saved games" has a changed appearance.
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\searches" has a changed appearance.
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\videos" has a changed appearance.
|
|
-
Folder "c:\users\all users\microsoft\windows\ringtones" has a changed appearance.
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu" has a changed appearance.
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories\accessibility" has a changed appearance.
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell" has a changed appearance.
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\games" has a changed appearance.
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\feeds cache\1nbur4hr" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\feeds cache\6asvn7j7" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\feeds cache\d68g7bij" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\feeds cache" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\feeds cache\kqmhsvkd" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\burn\burn" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\history" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\history\history.ie5" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\mm5o9xqs" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\pmmr5k9k" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\rijuql1c" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows mail\stationery" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\libraries" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\recent" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\sendto" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\users\default\contacts" has a changed appearance.
|
|
-
Folder "c:\users\default\desktop" has a changed appearance.
|
|
-
Folder "c:\users\default\documents" has a changed appearance.
|
|
-
Folder "c:\users\default\downloads" has a changed appearance.
|
|
-
Folder "c:\users\default\favorites" has a changed appearance.
|
|
-
Folder "c:\users\default\favorites\links" has a changed appearance.
|
|
-
Folder "c:\users\default\links" has a changed appearance.
|
|
-
Folder "c:\users\default\music" has a changed appearance.
|
|
-
Folder "c:\users\default\pictures" has a changed appearance.
|
|
-
Folder "c:\users\default\saved games" has a changed appearance.
|
|
-
Folder "c:\users\default\searches" has a changed appearance.
|
|
-
Folder "c:\users\default\videos" has a changed appearance.
|
|
-
Folder "c:\users" has a changed appearance.
|
|
1/5
|
File System
|
Creates an unusually large number of files
|
-
|
|
-
Creates an unusually large number of files.
|
|
1/5
|
Process
|
Overwrites code
|
-
|
|
-
Overwrites code to possibly hide behavior.
|
|
1/5
|
Network
|
Downloads data
|
Downloader
|
|
-
URL "http://paulmcnagets.ru/003/get.php?pid=33E9AA5ADDB65D39A5923495F06BCF33".
|
|
-
URL "http://jordan9908.ru/1.exe".
|
|
-
URL "http://jordan9908.ru/2.exe".
|
|
-
URL "http://jordan9908.ru/updatewin.exe".
|
|
-
URL "http://jordan9908.ru/4.exe".
|
|
1/5
|
Network
|
Connects to HTTP server
|
-
|
|
-
URL "http://paulmcnagets.ru/003/get.php?pid=33E9AA5ADDB65D39A5923495F06BCF33".
|
|
-
URL "http://jordan9908.ru/1.exe".
|
|
-
URL "http://jordan9908.ru/2.exe".
|
|
-
URL "http://jordan9908.ru/updatewin.exe".
|
|
-
URL "http://jordan9908.ru/4.exe".
|
|
1/5
|
PE
|
Drops PE file
|
Dropper
|
|
-
Drops file "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\ac0fced0-d42a-4728-a9f2-bdfd4590c238\1.exe".
|
|
-
Drops file "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\ac0fced0-d42a-4728-a9f2-bdfd4590c238\updatewin.exe".
|
|
-
Drops file "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\ac0fced0-d42a-4728-a9f2-bdfd4590c238\2.exe".
|
|
1/5
|
PE
|
Executes dropped PE file
|
-
|
|
-
Executes dropped file "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\ac0fced0-d42a-4728-a9f2-bdfd4590c238\1.exe".
|
|
-
Executes dropped file "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\ac0fced0-d42a-4728-a9f2-bdfd4590c238\updatewin.exe".
|
|
-
Executes dropped file "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\ac0fced0-d42a-4728-a9f2-bdfd4590c238\2.exe".
|
|
1/5
|
Process
|
Process crashed
|
-
|
|
-
Process "c:\windows\explorer.exe" crashed.
|