Analysis
-
max time kernel
98s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 05:46
Behavioral task
behavioral1
Sample
57d6c5ba858acc5374ca70c2479482c5.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
57d6c5ba858acc5374ca70c2479482c5.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
57d6c5ba858acc5374ca70c2479482c5.exe
-
Size
12.7MB
-
MD5
57d6c5ba858acc5374ca70c2479482c5
-
SHA1
a7ffdb8d73946c7716ceed2b9b83b9a53304b90a
-
SHA256
5aee0bd6a0910368344921324fb95e89878a8cf0cbf6e292287553b33940ff23
-
SHA512
3d014ea1d962509a2a91fc94096b78ad59d3c4c7db002aaf012da4fb10cae754d007fca313866c394c8368553df55d81eb2623df100852e5e190ad474281547c
-
SSDEEP
98304:jjBxcO4EYTj8osVNUbYZfgs0QlxBtLK3BDhtvS0Hpe4zbpaAKQkroGIVyVPKAF:jjBxcO4jj8nU64sIBnvjeApaAvktt
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 57d6c5ba858acc5374ca70c2479482c5.exe -
resource yara_rule behavioral1/memory/108-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/files/0x0001000000010498-7.dat upx behavioral1/memory/108-153-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" 57d6c5ba858acc5374ca70c2479482c5.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\LockFile.dat 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Windows\SysWOW64\DbTasker.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Windows\SysWOW64\DbTasker.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Windows\SysWOW64\hal.dll 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Windows\SysWOW64\DBTASK.EXE 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Windows\SysWOW64\dbzip2.dll 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Windows\SysWOW64\dbexe2.dll 57d6c5ba858acc5374ca70c2479482c5.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP2 WORKING activation crack.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\et-ee\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\numbers\Full warez download sites.html .pif 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\numbers\Pamela Anderson FULL VIDEO.mpg .scr 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\NORTON Internet security 2006.rar .scr 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\textconv\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\Full warez download sites.html .pif 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\office14\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\DVD Maker\DVDMaker.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\Internet Explorer 7 FULL BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\tr-tr\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\vgx\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\textconv\it-it\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\triedit\es-es\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\triedit\it-it\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\1033\Internet Explorer 7 FULL BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\bg-bg\NORTON Internet security 2006.rar .scr 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Full warez download sites.html .pif 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\msinfo\it-it\Internet Explorer 7 FULL BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\triedit\en-us\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\triedit\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\Internet Explorer 7 FULL BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\fr-fr\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\sl-si\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\en-us\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\pt-pt\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\textconv\en-us\Internet Explorer 7 FULL BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\Internet Explorer 7 FULL BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\lt-lt\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Full warez download sites.html .pif 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\triedit\it-it\Internet Explorer 7 FULL BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\Full warez download sites.html .pif 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\1033\DVD Xcopy PRO Illegal Warez.iso .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\vsto\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\numbers\Windows XP SP3 REAL VERSION.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\nb-no\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\ro-ro\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\msinfo\en-us\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\hwrcustomization\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\ink\pt-br\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\stationery\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\stationery\Full warez download sites.html .pif 57d6c5ba858acc5374ca70c2479482c5.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip 57d6c5ba858acc5374ca70c2479482c5.exe -
NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\s\Ú°¿Îñ8à(c:\program files\common files\microsoft shared\vsto\10.0\1033\Full warez download sites.html .pif 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\7ßÕvˆ3Oc:\program files\common files\microsoft shared\ink\ar-sa\Kazaa Lite 2005 Edition.rar .pif 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\et-ee\WinRAR 4.01 Cracked BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\filters\Windows XP SP3 REAL VERSION.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\åOÖvlê(c:\program files\common files\microsoft shared\textconv\Hacking and Virus Writing for Dummies.pdf .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\åOÖvÜç(c:\program files\common files\microsoft shared\textconv\fr-fr\Hacking and Virus Writing for Dummies.pdf .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\h5Ic:\program files\common files\microsoft shared\ink\ko-kr\Windows 2000.iso .com 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\pt-pt\WinRAR 4.01 Cracked BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\textconv\en-us\WinRAR 4.01 Cracked BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\h5Ic:\program files\common files\microsoft shared\filters\Windows 2000.iso .com 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\hwrcustomization\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\ko-kr\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\â(c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\WinRAR 4.01 Cracked BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\åOÖvlê(c:\program files\common files\microsoft shared\vsto\Hacking and Virus Writing for Dummies.pdf .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\åOÖvÜç(c:\program files\common files\microsoft shared\ink\ar-sa\Hacking and Virus Writing for Dummies.pdf .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\ink\da-dk\Windows XP SP3 REAL VERSION.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\msinfo\it-it\WinRAR 4.01 Cracked BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\&áœw ×(c:\program files\common files\microsoft shared\office14\cultures\Playboy centerfold HOT.gif .scr 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\åOÖvÜç(c:\program files\common files\microsoft shared\triedit\it-it\Hacking and Virus Writing for Dummies.pdf .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\filters\HalfLife 2 WORKING Steam Activation crack.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\¤^Tc:\program files\common files\microsoft shared\msinfo\en-us\Pamela Anderson FULL VIDEO.mpg .scr 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\msinfo\de-de\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\sk-sc:\program files\common files\microsoft shared\ink\sl-si\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\oft shared\textcc:\program files\common files\microsofc:\program files\common files\microsoft shared\triedit\en-us\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\h5Ic:\program files\common files\microsoft shared\vsto\Windows 2000.iso .com 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\ink\lt-lt\Windows XP SP3 REAL VERSION.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\sk-sk\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\officesoftwareprotectionplatform\Windows XP SP3 REAL VERSION.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\sr-latn-cs\WinRAR 4.01 Cracked BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\ink\sv-se\Windows XP SP3 REAL VERSION.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\c:\prog7c:\program files\common files\microsoft shared\triedit\en-us\Windows XP SP3 REAL VERSION.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\â(c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\WinRAR 4.01 Cracked BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\textconv\de-de\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\ink\ko-kr\Windows XP SP3 REAL VERSION.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\vsto\10.0\Visual Studio .NET FULL.zip .cpl 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\stationery\Windows XP SP3 REAL VERSION.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\¸c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\DVD Xcopy PRO Illegal Warez.iso .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\h5Ic:\program files\common files\microsoft shared\ink\fsdefinitions\main\Windows 2000.iso .com 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\â(c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\WinRAR 4.01 Cracked BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsofc:\program files\common files\microsoft shared\msinfo\en-us\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\v\Ú€+Èâ(c:\program files\common files\microsoft shared\msinfo\es-es\Full warez download sites.html .pif 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\fi-fi\WinRAR 4.01 Cracked BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\â(c:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\WinRAR 4.01 Cracked BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\zh-tw\WinRAR 4.01 Cracked BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\s\ÚPtòñs\Úc:\program files\common files\microsoft shared\office14\cultures\Full warez download sites.html .pif 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\f .exec:\program files\common files\microsoft shared\stationery\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\d9Oc:\program files\common files\microsoft shared\filters\Pamela Anderson FULL VIDEO.mpg .scr 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\cs-cc:\program files\common files\microsoft shared\ink\da-dk\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\åOÖvÜç(c:\program files\common files\microsoft shared\textconv\it-it\Hacking and Virus Writing for Dummies.pdf .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\v\ÚàÌÌv\Úc:\program files\common files\microsoft shared\triedit\it-it\Full warez download sites.html .pif 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ .cmdc:\program files\common files\microsoft shared\ink\cs-czc:\program files\common files\microsoft shared\ink\cs-cz\Kazaa Lite 2005 Edition.rar .pif 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\sk-sc:\program files\common files\microsoft shared\ink\sv-se\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\u\ÚàšŒ Èâ(c:\program files\common files\microsoft shared\msinfo\de-de\Full warez download sites.html .pif 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\vsto\10.0\1033\Playboy centerfold HOT.gif .scr 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\h5Ic:\program files\common files\microsoft shared\textconv\de-de\Windows 2000.iso .com 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\h5Ic:\program files\common files\microsoft shared\ink\pl-pl\Windows 2000.iso .com 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\tr-tr\WinRAR 4.01 Cracked BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\textconvc:\program files\common files\microsoft shared\textconv\en-us\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\s.pdf c:\program files\common files\microsoft shared\ink\fsdefinitions\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\ink\pt-pt\Windows XP SP3 REAL VERSION.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\h5Ic:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Windows 2000.iso .com 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\h5Ic:\program files\common files\microsoft shared\ink\sv-se\Windows 2000.iso .com 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\åOÖvÜç(c:\program files\common files\microsoft shared\ink\zh-tw\Hacking and Virus Writing for Dummies.pdf .exe 57d6c5ba858acc5374ca70c2479482c5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe 108 57d6c5ba858acc5374ca70c2479482c5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57d6c5ba858acc5374ca70c2479482c5.exe"C:\Users\Admin\AppData\Local\Temp\57d6c5ba858acc5374ca70c2479482c5.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.4MB
MD5bf55569dbc799ff7c5c827261e859b67
SHA1ed502457f4405c4b3fe310b4033615993c59bc13
SHA25628a8b424e0a5ac257359e747eedaf6aeb2581ceced489947c826ad74829a48f3
SHA5121f2a01f7a22472415afe8179e195b0a5473de3b5484e92d22134c48e91f08209f827695a83100afdcfe58f287d0050730315cf93bb8ad3c18c5c4260d72a5eb2