Analysis
-
max time kernel
26s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 05:46
Behavioral task
behavioral1
Sample
57d6c5ba858acc5374ca70c2479482c5.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
57d6c5ba858acc5374ca70c2479482c5.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
57d6c5ba858acc5374ca70c2479482c5.exe
-
Size
12.7MB
-
MD5
57d6c5ba858acc5374ca70c2479482c5
-
SHA1
a7ffdb8d73946c7716ceed2b9b83b9a53304b90a
-
SHA256
5aee0bd6a0910368344921324fb95e89878a8cf0cbf6e292287553b33940ff23
-
SHA512
3d014ea1d962509a2a91fc94096b78ad59d3c4c7db002aaf012da4fb10cae754d007fca313866c394c8368553df55d81eb2623df100852e5e190ad474281547c
-
SSDEEP
98304:jjBxcO4EYTj8osVNUbYZfgs0QlxBtLK3BDhtvS0Hpe4zbpaAKQkroGIVyVPKAF:jjBxcO4jj8nU64sIBnvjeApaAvktt
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 57d6c5ba858acc5374ca70c2479482c5.exe -
resource yara_rule behavioral2/memory/1156-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/files/0x000900000002314b-6.dat upx behavioral2/memory/1156-472-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" 57d6c5ba858acc5374ca70c2479482c5.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\LockFile.dat 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Windows\SysWOW64\DbTasker.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Windows\SysWOW64\DbTasker.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Windows\SysWOW64\hal.dll 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Windows\SysWOW64\DBTASK.EXE 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Windows\SysWOW64\dbzip2.dll 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Windows\SysWOW64\dbexe2.dll 57d6c5ba858acc5374ca70c2479482c5.exe -
Drops file in Program Files directory 50 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\WinAmp 5.08 FULL.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Internet Explorer\iexplore.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\7-Zip\7z.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\Pamela Anderson FULL VIDEO.mpg .scr 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\Visual Studio .NET FULL.zip .cpl 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\How to stop NetSky.doc .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\HalfLife 2 WORKING Steam Activation crack.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 57d6c5ba858acc5374ca70c2479482c5.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 57d6c5ba858acc5374ca70c2479482c5.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip 57d6c5ba858acc5374ca70c2479482c5.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1400 1156 WerFault.exe 17 -
NTFS ADS 15 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\P»xc:\program files\common files\microsoft shared\clicktorun\Windows 2000.iso .com 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\clicktorun\Internet Explorer 7 FULL BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\0,btþÿÿÿØßdc:\program files\common files\microsoft shared\clicktorun\Norton AntiVirus 2006 BETA.rar .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\Üdc:\program files\common files\microsoft shared\clicktorun\Playboy centerfold HOT.gif .scr 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\,]ÑvLêdc:\program files\common files\microsoft shared\clicktorun\Hacking and Virus Writing for Dummies.pdf .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\clicktorun\Matrix Reloaded.avi .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\clicktorun\Full warez download sites.html .pif 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\„ædc:\program files\common files\microsoft shared\clicktorun\Windows XP SP3 REAL VERSION.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\þÿÿÿXâdc:\program files\common files\microsoft shared\clicktorun\Hacking for Dummies.pdf .cpl 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\clicktorun\NORTON Internet security 2006.rar .scr 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\clicktorun\Windows XP SP2 WORKING activation crack.zip .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\KØ„~fâQMšÑ~…¾? % #bt Ñ^tœÜdc:\program files\common files\microsoft shared\clicktorun\Windows XP SECRET DEVELOPER serials.txt .cmd 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\Á3lJðédc:\program files\common files\microsoft shared\clicktorun\WinRAR 4.01 Cracked BETA.exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\ÿc:\program files\common files\microsoft shared\clicktorun\DVD Xcopy PRO Illegal Warez.iso .exe 57d6c5ba858acc5374ca70c2479482c5.exe File created C:\Users\Admin\AppData\Local\Temp\¨êxc:\program files\common files\microsoft shared\clicktorun\Kazaa Lite 2005 Edition.rar .pif 57d6c5ba858acc5374ca70c2479482c5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe 1156 57d6c5ba858acc5374ca70c2479482c5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57d6c5ba858acc5374ca70c2479482c5.exe"C:\Users\Admin\AppData\Local\Temp\57d6c5ba858acc5374ca70c2479482c5.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1156 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 36202⤵
- Program crash
PID:1400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1156 -ip 11561⤵PID:1816