Analysis
- max time kernel
133s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
30/12/2023, 03:10
Behavioral task
behavioral1
Sample
0c902a46294f93bf642e823e19b3ae82.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c902a46294f93bf642e823e19b3ae82.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 0c902a46294f93bf642e823e19b3ae82.exe
- Size 3.8MB
- Sample231230-dn95lshfdj
- SHA256 3b6938f15c45b86dfa3196bf07952b81b1c0769c6a970834d9da26feba424cd1
- MD5 0c902a46294f93bf642e823e19b3ae82
- SHA1 daeda6c347bceca170e40fda5a271e7aa361b06d
- SHA512 85baed1a824fe0c7237a8d383877403ad835ae8d7e3e8aa62370743db7cd973fd6d28631d63677bac20c9d4e5f285c8a8f20a06e77fb5a582404c7362b067b8d
- SSDEEP 98304:jjBxcO4EYTjLrRokT7JdXN0B7+sPhjBxcO4EYTjLrRokT7JdXN0B7+sL:jjBxcO4jjqhhjBxcO4jjqN
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 0c902a46294f93bf642e823e19b3ae82.exe -
resource yara_rule behavioral2/memory/4904-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/files/0x0007000000023232-5.dat upx behavioral2/memory/4904-763-0x0000000000400000-0x0000000000450000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" 0c902a46294f93bf642e823e19b3ae82.exe - Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\hal.dll 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Windows\SysWOW64\DBTASK.EXE 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Windows\SysWOW64\dbzip2.dll 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Windows\SysWOW64\dbexe2.dll 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Windows\SysWOW64\LockFile.dat 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Windows\SysWOW64\DbTasker.exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Windows\SysWOW64\DbTasker.exe 0c902a46294f93bf642e823e19b3ae82.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\textconv\en-us\Full warez download sites.html .pif 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\dotnet\shared\m0ædc:\program files\dotnet\shared\microsoft.windowsd•þ4™Â4ˆãdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\it\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\ja\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\he-il\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\Matrix Reloaded.avi .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\Full warez download sites.html .pif 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\tr\Full warez download sites.html .pif 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\tr-tr\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\8.0.0\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\msinfo\de-de\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\office16\office setup controller\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\uk-ua\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\fr\Internet Explorer 7 FULL BETA.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\ko\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\zh-hans\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\Full warez download sites.html .pif 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\Playboy centerfold HOT.gif .scr 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\dotnet\shared\m0ædc:\program files\dotnet\shared\microsoft.windowsd•þ4™Â4ˆãdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\zh-hant\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\miÀèdc:\program files\common files\microsoft shared\ink\sk-sk\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\dotnet\shared\m0ædc:\program files\dotnet\shared\microsoft.windowsd•þ4™Â4ˆãdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\ja\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\insert\Full warez download sites.html .pif 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\Full warez download sites.html .pif 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\pl\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\nb-no\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\pl-pl\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\pt-br\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\Pamela Anderson FULL VIDEO.mpg .scr 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\dotnet\shared\m0ædc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\de\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\da-dk\Internet Explorer 7 FULL BETA.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\hr-hr\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\Full warez download sites.html .pif 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\WinAmp 5.08 FULL.zip Ã4 Ç4ædc:\program files\common files\microsoft shared\ink\ko-kr\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\msinfo\fr-fr\How to stop NetSky.doc .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\triedit\en-us\Windows XP SP3 REAL VERSION.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\tr-tr\WinAmp 5.08 FULL.zip Ã4 Ç4ædc:\program files\common files\microsoft shared\ink\zh-cn\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip 0c902a46294f93bf642e823e19b3ae82.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2400 4904 WerFault.exe 17 - NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\ÑÅ4`çdc:\program files\common files\microsoft shared\ink\el-gr\WinRAR 4.01 Cracked BETA.exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\,]Öu¼çdc:\program files\common files\microsoft shared\ink\es-mx\Hacking and Virus Writing for Dummies.pdf .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program fÿc:\program files\common files\microsoft shared\ink\da-dk\WinAmp 5.08 FÃ4 Ç4ædc:\program files\common files\microsoft shared\ink\et-ee\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\øt#3c:\program files\common files\microsoft shared\msinfo\en-us\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\øy#3c:\program files\common files\microsoft shared\vsto\10.0\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\WinAmp 5.08 FULL.zip Ã4 Ç4ædc:\program files\common files\microsoft shared\ink\lt-lt\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\,]Öu¼çdc:\program files\common files\microsoft shared\ink\da-dk\Hacking and Virus Writing for Dummies.pdf .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\,]Öu,ådc:\program files\common files\microsoft shared\ink\fsdefinitions\insert\Hacking and Virus Writing for Dummies.pdf .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Full warez download sites.html .pif 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\„ædc:\program files\common files\microsoft shared\msinfo\Windows XP SP3 REAL VERSION.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\Ûdc:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP2 WORKING activation crack.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\,]Öu¼çdc:\program files\common files\microsoft shared\ink\fr-fr\Hacking and Virus Writing for Dummies.pdf .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\program files\common files\microsoft shared\inkc:\program files\common files\microsoÃ4 Ç4ædc:\program files\common files\microsoft shared\msinfo\en-us\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\miÀèdc:\program files\common files\microsoft shared\inÃ4 Ç4ædc:\program files\common files\microsoft shared\ink\sv-se\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\¸m#3c:\program files\common files\microsoft shared\msinfo\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\xm#3c:\program files\common files\microsoft shared\ink\zh-cn\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\„ædc:\program files\common files\microsoft shared\vsto\Windows XP SP3 REAL VERSION.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\x~#3c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\tr\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\€ßdc:\program files\common files\microsoft shared\ink\ar-sa\Hacking for Dummies.pdf .cpl 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\h„wc:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\Pamela Anderson FULL VIDEO.mpg .scr 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\,]Öu,ådc:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\Hacking and Virus Writing for Dummies.pdf .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\,]Öu,ådc:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\Hacking and Virus Writing for Dummies.pdf .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\ÑÅ4`çdc:\program files\common files\microsoft shared\ink\it-it\WinRAR 4.01 Cracked BETA.exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\ø{#3c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\zh-hans\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\¸f#3c:\program files\common files\microsoft shared\ink\fsdefinitions\main\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\,]Öu,ådc:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\Hacking and Virus Writing for Dummies.pdf .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\¸d#3c:\program files\common files\microsoft shared\ink\hwrcustomization\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\ðÜdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\fr\Hacking for Dummies.pdf .cpl 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\ÑÅ4`çdc:\program files\common files\microsoft shared\ink\fi-fi\WinRAR 4.01 Cracked BETA.exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\øh#3c:\program files\common files\microsoft shared\ink\fsdefinitions\insert\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\h„w€c:\program files\common files\microsoft shared\ink\fsdefinitions\insert\Pamela Anderson FULL VIDEO.mpg .scr 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\Àc:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\Matrix Reloaded.avi .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\AÆ4ðédc:\program files\common files\microsoft shared\stationery\WinRAR 4.01 Cracked BETA.exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\8i#3c:\program files\common files\microsoft shared\ink\cs-cz\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program fÿc:\program files\common files\microsoft shared\ink\da-dk\WinAmp 5.08 FÃ4 Ç4ædc:\program files\common files\microsoft shared\ink\de-de\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\!Ã4Ðädc:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\WinRAR 4.01 Cracked BETA.exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\øv#3c:\program files\common files\microsoft shared\msinfo\it-it\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\vsto\10.0\1033\Playboy centerfold HOT.gif .scr 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\8{#3c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\pl\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\als.txt .cmdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\es\Kazaa Lite 2005 Edition.rar .pif 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\ÑÅ4`çdc:\program files\common files\microsoft shared\ink\hu-hu\WinRAR 4.01 Cracked BETA.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\WinAmp 5.08 FULL.zip Ã4 Ç4ædc:\program files\common files\microsoft shared\ink\ko-kr\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\common files\miµÅ4¹É4¨èdc:\program files\common files\microsoft shared\vc\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\8o#3c:\program files\common files\microsoft shared\ink\sk-sk\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\8€#3c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\fr\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\,]Öu,ådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\tr\Hacking and Virus Writing for Dummies.pdf .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\¸}#3c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\it\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\È „c:\program files\common files\microsoft shared\ink\ar-sa\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\xw#3c:\program files\common files\microsoft shared\vgx\Windows 2000.iso .com 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\common files\microsoft shared\vsto\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\common files\microsoft shared\msinfo\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\crc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\cs\Norton AntiVirus 2006 BETA.rar .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\ for Dummies.pdf .exec:\program fiµÅ4¹É4¨èdc:\program files\common files\microsoft shared\source engine\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\,]Öu,ådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\pl\Hacking and Virus Writing for Dummies.pdf .exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\dotnet\shared\m0ædc:\program files\dotnet\shared\microsoft.windowsd•þ4™Â4ˆãdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\zh-hant\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\,]Öu¼çdc:\program files\common files\microsoft shared\ink\et-ee\Hacking and Virus Writing for Dummies.pdf .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\,]Öu¼çdc:\program files\common files\microsoft shared\ink\pt-br\Hacking and Virus Writing for Dummies.pdf .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\ÑÅ4`çdc:\program files\common files\microsoft shared\ink\zh-tw\WinRAR 4.01 Cracked BETA.exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\,]Öu¼çdc:\program files\common files\microsoft shared\ink\ko-kr\Hacking and Virus Writing for Dummies.pdf .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\program files\common files\microsoft shared\inkc:\program files\common files\microsoÃ4 Ç4ædc:\program files\common files\microsoft shared\msinfo\it-it\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\Full warez download sites.html .pif 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\AÆ4ðédc:\program files\common files\microsoft shared\vsto\WinRAR 4.01 Cracked BETA.exe 0c902a46294f93bf642e823e19b3ae82.exe File created \??\c:\program files\common files\microsoft shared\ink\tr-tr\WinAmp 5.08 FULL.zip Ã4 Ç4ædc:\program files\common files\microsoft shared\ink\uk-ua\WinAmp 5.08 FULL.zip .exe 0c902a46294f93bf642e823e19b3ae82.exe File created C:\Users\Admin\AppData\Local\Temp\,]Öu¼çdc:\program files\common files\microsoft shared\msinfo\fr-fr\Hacking and Virus Writing for Dummies.pdf .exe 0c902a46294f93bf642e823e19b3ae82.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe 4904 0c902a46294f93bf642e823e19b3ae82.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c902a46294f93bf642e823e19b3ae82.exe"C:\Users\Admin\AppData\Local\Temp\0c902a46294f93bf642e823e19b3ae82.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4904 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 46482⤵
- Program crash
PID:2400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4904 -ip 49041⤵PID:4816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
- Size 65KB
- SHA256 dd774488059a479bcb4922263fe24ece974ca9c3331fee5dc6e28437379edb30
- MD5 028885ac21d3b50fa441496c9921413a
- SHA1 1901c6053e0624687eb191aaf5113403d98aa397
- SHA512 08343988ea7ceca183f25d89ced53b237cae34ab91f9c07c8796a6208eb952cb37b6ad1b0f1cb276b75e7ce801573fce1d90b6dfb2ff2cd90c3c1cca66d9bdc0
- SSDEEP 1536:j0vk4tH2ofZMJopTbDSErIz30YHPT+sJ/XS8skl:jikM2dyDSIw51K8sw
- MD5 SHA1 SHA512 SSDEEP