Analysis
-
max time kernel
1617s -
max time network
1622s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 04:57
Static task
static1
Behavioral task
behavioral1
Sample
a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe
Resource
win10v2004-20220414-en
General
-
Target
a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe
-
Size
1.5MB
-
MD5
9e8e4f323680068c692fd63fdb905ba4
-
SHA1
956db18ac228c46e8351b94636d2de865a08927f
-
SHA256
a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f
-
SHA512
6c14d057e4a15ce50164e5559df24a266b50cc94698420b85fd78e1406c37fa6fe59c104509d5803107651d4dd588653eedf02d4c951bca11d0310030f34f656
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exedescription ioc process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe -
Processes:
resource yara_rule behavioral1/memory/1808-55-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1808-56-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe -
Drops file in System32 directory 7 IoCs
Processes:
a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exedescription ioc process File created C:\Windows\SysWOW64\hal.dll a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Windows\SysWOW64\DBTASK.EXE a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Windows\SysWOW64\dbzip2.dll a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Windows\SysWOW64\dbexe2.dll a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Windows\SysWOW64\LockFile.dat a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Windows\SysWOW64\DbTasker.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Windows\SysWOW64\DbTasker.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe -
Drops file in Program Files directory 64 IoCs
Processes:
a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\filters\Windows XP SP2 WORKING activation crack.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\msinfo\de-de\DVD Xcopy PRO Illegal Warez.iso .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\textconv\fr-fr\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\triedit\de-de\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\1033\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\msinfo\es-es\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\vc\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\HalfLife 2 WORKING Steam Activation crack.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\Internet Explorer 7 FULL BETA.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\en-us\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\zh-cn\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\ko-kr\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\pt-br\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\triedit\es-es\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Pamela Anderson FULL VIDEO.mpg .scr a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\triedit\it-it\Internet Explorer 7 FULL BETA.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\triedit\ja-jp\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\1033\DVD Xcopy PRO Illegal Warez.iso .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\textconv\de-de\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\triedit\en-us\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\7-Zip\7z.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Program Files\DVD Maker\DVDMaker.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\msinfo\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\filters\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\Internet Explorer 7 FULL BETA.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\textconv\it-it\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\msinfo\ja-jp\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\textconv\it-it\Internet Explorer 7 FULL BETA.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\filters\NORTON Internet security 2006.rar .scr a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\NORTON Internet security 2006.rar .scr a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\bg-bg\NORTON Internet security 2006.rar .scr a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\tr-tr\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\triedit\it-it\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\vgx\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\es-es\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created \??\c:\program files\common files\microsoft shared\ink\pt-pt\How to stop NetSky.doc .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe -
Drops file in Windows directory 1 IoCs
Processes:
a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exedescription ioc process File created C:\Windows\WinTask.zip a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2088 1808 WerFault.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe -
NTFS ADS 64 IoCs
Processes:
a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\he-il\WinRAR 4.01 Cracked BETA.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\textconv\de-de\WinAmp 5.08 FULL.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\fi-fi\WinRAR 4.01 Cracked BETA.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\åOruÜç(c:\program files\common files\microsoft shared\ink\it-it\Hacking and Virus Writing for Dummies.pdf .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\P6{c:\program files\common files\microsoft shared\ink\pt-br\Windows 2000.iso .com a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\|ç(c:\program files\common files\microsoft shared\stationery\WinRAR 4.01 Cracked BETA.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\3¨c:\program files\common files\microsoft shared\filters\Hacking for Dummies.pdf .cpl a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\2Ït2ÏtÄÂßïc:\program files\common files\microsoft shared\filters\Windows XP SECRET DEVELOPER serials.txt .cmd a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\7ßquH–~c:\program files\common files\microsoft shared\ink\ar-sa\Kazaa Lite 2005 Edition.rar .pif a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\.PØö$cÈâ(c:\program files\common files\microsoft shared\msinfo\it-it\Full warez download sites.html .pif a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\stationery\Windows XP SP3 REAL VERSION.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\P6{c:\program files\common files\microsoft shared\textconv\es-es\Windows 2000.iso .com a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\åOruLå(c:\program files\common files\microsoft shared\ink\fsdefinitions\numbers\Hacking and Virus Writing for Dummies.pdf .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\Ðc:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Full warez download sites.html .pif a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\Windows XP SP3 REAL VERSION.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\triedit\de-de\Windows XP SP3 REAL VERSION.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\1Êc:\program files\common files\microsoft shared\ink\ar-sa\Full warez download sites.html .pif a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\sk-sk\WinAmp 5.08 FULL.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\êøËc:\program files\common files\microsoft shared\textconv\en-us\Full warez download sites.html .pif a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\it-it\WinRAR 4.01 Cracked BETA.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\åOruÜç(c:\program files\common files\microsoft shared\ink\ko-kr\Hacking and Virus Writing for Dummies.pdf .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\åOruÜç(c:\program files\common files\microsoft shared\ink\sv-se\Hacking and Virus Writing for Dummies.pdf .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\åOruÜç(c:\program files\common files\microsoft shared\msinfo\fr-fr\Hacking and Virus Writing for Dummies.pdf .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\&áÿv ×(c:\program files\common files\microsoft shared\textconv\de-de\Playboy centerfold HOT.gif .scr a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\ø;c:\program files\common files\microsoft shared\ink\bg-bg\WinAmp 5.08 FULL.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\,PØ ë›Èâ(c:\program files\common files\microsoft shared\ink\de-de\Full warez download sites.html .pif a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\åOruLå(c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Hacking and Virus Writing for Dummies.pdf .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\Òàÿvt|€cc:\program files\common files\microsoft shared\textconv\es-es\Windows XP SP3 REAL VERSION.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\.PØö$c.PØc:\program files\common files\microsoft shared\textconv\it-it\Full warez download sites.html .pif a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\Bc:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\WinAmp 5.08 FULL.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\tr-tr\WinAmp 5.08 FULL.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\triedit\en-us\WinRAR 4.01 Cracked BETA.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\c:\progc:\program files\common files\microsoft shared\triedit\es-es\Windows XP SP3 REAL VERSION.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\ .cmdc:\program files\common files\microsoft shared\vsto\10.0\Playboy centerfold HOT.gif .scr a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\åOruÜç(c:\program files\common files\microsoft shared\ink\bg-bg\Hacking and Virus Writing for Dummies.pdf .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\3¨c:\program files\common files\microsoft shared\ink\da-dk\Hacking for Dummies.pdf .cpl a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\åOruLå(c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Hacking and Virus Writing for Dummies.pdf .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\4€€c:\program files\common files\microsoft shared\ink\ar-sa\Pamela Anderson FULL VIDEO.mpg .scr a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\P6{c:\program files\common files\microsoft shared\triedit\es-es\Windows 2000.iso .com a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\el-gr\WinRAR 4.01 Cracked BETA.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\P6{c:\program files\common files\microsoft shared\ink\en-us\Windows 2000.iso .com a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\Bc:\program files\common files\microsoft shared\ink\fsdefinitions\numbers\WinAmp 5.08 FULL.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\lt-lt\WinRAR 4.01 Cracked BETA.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\uk-ua\WinRAR 4.01 Cracked BETA.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\ðÎc:\program files\common files\microsoft shared\filters\Windows 2000.iso .com a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\ar-sa\WinRAR 4.01 Cracked BETA.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\ink\da-dk\Windows XP SP3 REAL VERSION.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\P6{c:\program files\common files\microsoft shared\vc\Windows 2000.iso .com a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\,PØ á›Èâ(c:\program files\common files\microsoft shared\msinfo\de-de\Full warez download sites.html .pif a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\msinfo\dc:\program files\common files\microsoft shared\msinfo\en-us\WinAmp 5.08 FULL.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\,PØ á›,PØc:\program files\common files\microsoft shared\triedit\de-de\Full warez download sites.html .pif a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\textconvc:\program files\common files\microsoft shared\textconv\ja-jp\WinAmp 5.08 FULL.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\åOruÜç(c:\program files\common files\microsoft shared\triedit\ja-jp\Hacking and Virus Writing for Dummies.pdf .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\1c:\program files\common files\microsoft shared\ink\ar-sa\Norton AntiVirus 2006 BETA.rar .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\P6{c:\program files\common files\microsoft shared\ink\he-il\Windows 2000.iso .com a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\nb-no\WinRAR 4.01 Cracked BETA.exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\n files\microsoft shared\ink\fsdefinitions\numbersc:\program files\common files\öc:\program files\common files\microsoft shared\msinfo\de-de\Visual Studio .NET FULL.zip .cpl a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\H”€c:\program files\common files\microsoft shared\office14\cultures\Windows 2000.iso .com a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\f .exec:\program files\common files\microsoft shared\office14\WinAmp 5.08 FULL.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\Òàÿvt|€cc:\program files\common files\microsoft shared\textconv\fr-fr\Windows XP SP3 REAL VERSION.zip .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\êøËc:\program files\common files\microsoft shared\triedit\en-us\Full warez download sites.html .pif a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\åOruLå(c:\program files\common files\microsoft shared\ink\fsdefinitions\web\Hacking and Virus Writing for Dummies.pdf .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\åOruÜç(c:\program files\common files\microsoft shared\ink\fsdefinitions\Hacking and Virus Writing for Dummies.pdf .exe a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe File created C:\Users\Admin\AppData\Local\Temp\P6{c:\program files\common files\microsoft shared\ink\nl-nl\Windows 2000.iso .com a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exepid process 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exedescription pid process target process PID 1808 wrote to memory of 2088 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe WerFault.exe PID 1808 wrote to memory of 2088 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe WerFault.exe PID 1808 wrote to memory of 2088 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe WerFault.exe PID 1808 wrote to memory of 2088 1808 a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe"C:\Users\Admin\AppData\Local\Temp\a11a021a9b1151dc83cde99ce61b13a6cada6069c4cbfef73e528c815e6e5b1f.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 41322⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1808-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmpFilesize
8KB
-
memory/1808-55-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1808-56-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2088-57-0x0000000000000000-mapping.dmp