Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/01/2024, 15:14
Behavioral task
behavioral1
Sample
6fc1e1a0de11010dc449d4afa73d637b.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
6fc1e1a0de11010dc449d4afa73d637b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
6fc1e1a0de11010dc449d4afa73d637b.exe
-
Size
4.6MB
-
MD5
6fc1e1a0de11010dc449d4afa73d637b
-
SHA1
4a09a90a1b675d7bb4b4dc5a0647ebde11a38f97
-
SHA256
d90351764ecbd55268dcf03153be4f3b1f5680b53938e2a9c276d8c6add7fb9f
-
SHA512
31776154dd51440a3c1baf60c60ca29ba7c7c20febdcf93d0fe1a53eabb13b7861426968ecb461965bffc5ec47dad23e0d2d3ab92a04d825195cbd25472cf245
-
SSDEEP
49152:jj9LxcO4Q5YTjWNEHJKrtJEjfr4rJLO+u+v9ML+Qn/Jf4MgVrVjnTKAdo+QnXXAE:jjBxcO4EYTj0tJKaa+/9SyVPKAg2WHj
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 6fc1e1a0de11010dc449d4afa73d637b.exe -
resource yara_rule behavioral1/memory/2188-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/files/0x0003000000010485-7.dat upx behavioral1/memory/2188-273-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" 6fc1e1a0de11010dc449d4afa73d637b.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DbTasker.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Windows\SysWOW64\hal.dll 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Windows\SysWOW64\DBTASK.EXE 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Windows\SysWOW64\dbzip2.dll 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Windows\SysWOW64\dbexe2.dll 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Windows\SysWOW64\LockFile.dat 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Windows\SysWOW64\DbTasker.exe 6fc1e1a0de11010dc449d4afa73d637b.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files\common files\microsoft shared\ink\bg-bg\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\pl-pl\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\sk-sk\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\Internet Explorer 7 FULL BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\hwrcustomization\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\nb-no\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\office14\cultures\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\triedit\en-us\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\triedit\es-es\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\Internet Explorer 7 FULL BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\filters\Internet Explorer 7 FULL BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\en-us\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\msinfo\it-it\Internet Explorer 7 FULL BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\textconv\es-es\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\triedit\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\fr-fr\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\hu-hu\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\textconv\de-de\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\textconv\it-it\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\bg-bg\Internet Explorer 7 FULL BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\da-dk\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Windows XP SP3 REAL VERSION.zip .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Program Files\Internet Explorer\iexplore.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File opened for modification C:\Program Files\7-Zip\7z.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\WinAmp 5.08 FULL.zip .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\triedit\fr-fr\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\zh-tw\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\fi-fi\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\he-il\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\ja-jp\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\msinfo\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\de-de\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\web\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\msinfo\de-de\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\HalfLife 2 WORKING Steam Activation crack.zip .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\1033\DVD Xcopy PRO Illegal Warez.iso .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\et-ee\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\numbers\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Pamela Anderson FULL VIDEO.mpg .scr 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\msinfo\es-es\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\triedit\it-it\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\WinAmp 5.08 FULL.zip .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created \??\c:\program files\common files\microsoft shared\ink\pt-br\How to stop NetSky.doc .exe 6fc1e1a0de11010dc449d4afa73d637b.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip 6fc1e1a0de11010dc449d4afa73d637b.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2724 2188 WerFault.exe 27 -
NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\el-gc:\program files\common files\microsoft shared\ink\es-es\WinAmp 5.08 FULL.zip .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\ink\hr-hr\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\ro-ro\WinRAR 4.01 Cracked BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\o\ÚÀ2!Èâ(c:\program files\common files\microsoft shared\msinfo\es-es\Full warez download sites.html .pif 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\ink\da-dk\Windows XP SP3 REAL VERSION.zip .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\îqc:\program files\common files\microsoft shared\ink\de-de\Pamela Anderson FULL VIDEO.mpg .scr 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fr-fr\WinAmp 5.08 FULL.zip .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\nb-nc:\program files\common files\microsoft shared\ink\nl-nl\WinAmp 5.08 FULL.zip .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\åO wÜç(c:\program files\common files\microsoft shared\ink\sv-se\Hacking and Virus Writing for Dummies.pdf .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\ink\th-th\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\mmon files\microc:\program files\common files\microsofc:\program files\common files\microsoft shared\msinfo\en-us\WinAmp 5.08 FULL.zip .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\3¨‚wc:\program files\common files\microsoft shared\ink\ar-sa\Hacking for Dummies.pdf .cpl 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\â(c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\WinRAR 4.01 Cracked BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\sv-se\WinRAR 4.01 Cracked BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\åO wÜç(c:\program files\common files\microsoft shared\textconv\es-es\Hacking and Virus Writing for Dummies.pdf .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\triedit\en-us\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\åO wÜç(c:\program files\common files\microsoft shared\vsto\10.0\Hacking and Virus Writing for Dummies.pdf .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\fr-fr\WinRAR 4.01 Cracked BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\nl-nl\WinRAR 4.01 Cracked BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\stationery\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\|ç(c:\program files\common files\microsoft shared\vgx\WinRAR 4.01 Cracked BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\åO wÜç(c:\program files\common files\microsoft shared\ink\el-gr\Hacking and Virus Writing for Dummies.pdf .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\â(c:\program files\common files\microsoft shared\ink\fsdefinitions\main\WinRAR 4.01 Cracked BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\åO wÜç(c:\program files\common files\microsoft shared\ink\hr-hr\Hacking and Virus Writing for Dummies.pdf .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\n\Ú`˜·SÈâ(c:\program files\common files\microsoft shared\msinfo\fr-fr\Full warez download sites.html .pif 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\£<‚wc:\program files\common files\microsoft shared\filters\WinAmp 5.08 FULL.zip .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\åO wÜç(c:\program files\common files\microsoft shared\ink\pl-pl\Hacking and Virus Writing for Dummies.pdf .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\3¨‚wc:\program files\common files\microsoft shared\ink\da-dk\Hacking for Dummies.pdf .cpl 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\øÙvc:\program files\common files\microsoft shared\ink\fsdefinitions\main\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\nb-nc:\program files\common files\microsoft shared\ink\ro-ro\WinAmp 5.08 FULL.zip .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\&áw ×(c:\program files\common files\microsoft shared\textconv\de-de\Playboy centerfold HOT.gif .scr 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\vsto\10.0\WinRAR 4.01 Cracked BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\ ¯rc:\program files\common files\microsoft shared\vsto\10.0\1033\Windows XP SECRET DEVELOPER serials.txt .cmd 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\Xc:\program files\common files\microsoft shared\filters\DVD Xcopy PRO Illegal Warez.iso .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\ink\fsdefinitions\numbers\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\åO wÜç(c:\program files\common files\microsoft shared\ink\ja-jp\Hacking and Virus Writing for Dummies.pdf .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\triedit\es-es\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\ÔKvc:\program files\common files\microsoft shared\triedit\it-it\Pamela Anderson FULL VIDEO.mpg .scr 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\íqc:\program files\common files\microsoft shared\ink\bg-bg\Pamela Anderson FULL VIDEO.mpg .scr 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\ink\uk-ua\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\$â(c:\program files\common files\microsoft shared\ink\bg-bg\NORTON Internet security 2006.rar .scr 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\ink\de-de\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\ink\pl-pl\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\´skc:\program files\common files\microsoft shared\filters\Playboy centerfold HOT.gif .scr 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\textconv\de-de\WinAmp 5.08 FULL.zip .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\msinfo\en-us\WinRAR 4.01 Cracked BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\office14\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\textconv\es-es\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\c:\c:\program files\common files\microsoft shared\triedit\it-it\Windows XP SP3 REAL VERSION.zip .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\hÑ(c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Visual Studio .NET FULL.zip .cpl 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\åO wÜç(c:\program files\common files\microsoft shared\ink\ko-kr\Hacking and Virus Writing for Dummies.pdf .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\ä4uc:\program files\common files\microsoft shared\textconv\de-de\Pamela Anderson FULL VIDEO.mpg .scr 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\â(c:\program files\common files\microsoft shared\ink\fsdefinitions\web\WinRAR 4.01 Cracked BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\ink\fsdefinitions\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\office14\cultures\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\officesoftwareprotectionplatform\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\Pc:\program files\common files\microsoft shared\textconv\de-de\DVD Xcopy PRO Illegal Warez.iso .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\textconv\it-it\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\textconvc:\program files\common files\microsoft shared\textconv\it-it\WinAmp 5.08 FULL.zip .exe 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\h5kc:\program files\common files\microsoft shared\ink\el-gr\Windows 2000.iso .com 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\d9uc:\program files\common files\microsoft shared\textconv\it-it\Pamela Anderson FULL VIDEO.mpg .scr 6fc1e1a0de11010dc449d4afa73d637b.exe File created C:\Users\Admin\AppData\Local\Temp\|ç(c:\program files\common files\microsoft shared\vc\WinRAR 4.01 Cracked BETA.exe 6fc1e1a0de11010dc449d4afa73d637b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 2188 6fc1e1a0de11010dc449d4afa73d637b.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2724 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 28 PID 2188 wrote to memory of 2724 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 28 PID 2188 wrote to memory of 2724 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 28 PID 2188 wrote to memory of 2724 2188 6fc1e1a0de11010dc449d4afa73d637b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fc1e1a0de11010dc449d4afa73d637b.exe"C:\Users\Admin\AppData\Local\Temp\6fc1e1a0de11010dc449d4afa73d637b.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 23082⤵
- Program crash
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5213a2bcf83f5210d6fb8a223b17d5728
SHA11427d7776d1ab1d1c3244be98354a5c8f0c4052a
SHA256083a7ed6b7e993ca02eb3d9b55a9c86308fb80190b886b39443d3ed0698717ec
SHA512bdfdb17f100896d26ca6fbe829d3698fb3d0feae0d145b579c2d1962532d09f61d4a0ac360bd028fc3d8cef138fa315031b69fcaa5bd9c30d7036a2be7f68355