Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2024, 22:37
Behavioral task
behavioral1
Sample
87d88b17ea5fe29ec4d02dff72226d7f.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
87d88b17ea5fe29ec4d02dff72226d7f.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
87d88b17ea5fe29ec4d02dff72226d7f.exe
-
Size
6.7MB
-
MD5
87d88b17ea5fe29ec4d02dff72226d7f
-
SHA1
b43af9a699ab8a5e9eab69426840794e361bd10b
-
SHA256
53ebd9deb41cc65931017caf90b1b5b2133e69cf101713da7680fa1f628a09c4
-
SHA512
a4d8b6b9c520b862c45a4eaed4a8b51bd8788d12a1226dce606faef69d61303b748450c701bbfc0e209b397f499a17018ea1a77825489246ee1fa5c0c6b494f6
-
SSDEEP
196608:jjBxcO4jjohYvovydeG/Oas7FVr8oP301b:zR3vydenVrd6
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 87d88b17ea5fe29ec4d02dff72226d7f.exe -
resource yara_rule behavioral2/memory/3300-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/files/0x0007000000023203-5.dat upx behavioral2/memory/3300-522-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" 87d88b17ea5fe29ec4d02dff72226d7f.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\dbexe2.dll 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Windows\SysWOW64\LockFile.dat 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Windows\SysWOW64\DbTasker.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File opened for modification C:\Windows\SysWOW64\DbTasker.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Windows\SysWOW64\hal.dll 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Windows\SysWOW64\DBTASK.EXE 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Windows\SysWOW64\dbzip2.dll 87d88b17ea5fe29ec4d02dff72226d7f.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Playboy centerfold HOT.gif .scr 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\ru-ru\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\office16\office setup controller\Pamela Anderson FULL VIDEO.mpg .scr 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\cs\Full warez download sites.html .pif 87d88b17ea5fe29ec4d02dff72226d7f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\pt-br\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\office16\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\textconv\en-us\Playboy centerfold HOT.gif .scr 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\cs\Pamela Anderson FULL VIDEO.mpg .scr 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\Matrix Reloaded.avi .exec:\program files\common files\microsoft shared\ink\bg-bg\Matrix Reloaded.avi .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\da-dk\Full warez download sites.html .pif 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\et-ee\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\msinfo\es-es\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\textconv\en-us\DVD Xcopy PRO Illegal Warez.iso .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\ru\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\bg-bg\Internet Explorer 7 FULL BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\th-th\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\bg-bg\Full warez download sites.html .pif 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\Pamela Anderson FULL VIDEO.mpg .scr 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\msinfo\ja-jp\Internet Explorer 7 FULL BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\triedit\en-us\DVD Xcopy PRO Illegal Warez.iso .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\vgx\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\1033\Full warez download sites.html .pif 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\ko\Full warez download sites.html .pif 87d88b17ea5fe29ec4d02dff72226d7f.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\da-dk\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\en-gb\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\es-es\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\stationery\Full warez download sites.html .pif 87d88b17ea5fe29ec4d02dff72226d7f.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\Full warez download sites.html .pif 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\lv-lv\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\HalfLife 2 WORKING Steam Activation crack.zip .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\Windows XP SP3 REAL VERSION.zip .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\pt-pt\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\msinfo\ja-jp\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\Internet Explorer 7 FULL BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\uk-ua\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\office16\office setup controller\Full warez download sites.html .pif 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\office16\office setup controller\Playboy centerfold HOT.gif .scr 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\triedit\en-us\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\1033\DVD Xcopy PRO Illegal Warez.iso .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\zh-hant\How to stop NetSky.doc .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\Pamela Anderson FULL VIDEO.mpg .scr 87d88b17ea5fe29ec4d02dff72226d7f.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip 87d88b17ea5fe29ec4d02dff72226d7f.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1424 3300 WerFault.exe 84 -
NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\¥ü[Ë`çdc:\program files\common files\microsoft shared\ink\en-gb\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\WinAmp 5.08 FULL.zip .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\¥ü[Ë`çdc:\program files\common files\microsoft shared\ink\sk-sk\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\¥ü[Ë`çdc:\program files\common files\microsoft shared\ink\tr-tr\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\°ãsc:\program files\common files\microsoft shared\msinfo\de-de\Windows 2000.iso .com 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\Üdc:\program files\common files\microsoft shared\clicktorun\Playboy centerfold HOT.gif .scr 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\vsto\10.0\1033\Playboy centerfold HOT.gif .scr 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\€ßdc:\program files\common files\microsoft shared\ink\cs-cz\Hacking for Dummies.pdf .cpl 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\ðÛsc:\program files\common files\microsoft shared\ink\fr-fr\Windows 2000.iso .com 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\,]c:\program files\common files\microsoft shared\ink\sl-si\Hacking and Virus Writing for Dummies.pdf .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\çc:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Visual Studio .NET FULL.zip .cpl 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\pÜsc:\program files\common files\microsoft shared\ink\fsdefinitions\main\Windows 2000.iso .com 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\ .cplc:\progÿc:\program files\common files\microsoft shared\ink\hr-hr\WinAmp 5.08 FULL.zip .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program fc:\program files\common files\microsoft shared\ink\nl-nl\WinAmp 5.08 FULL.zip .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\˜sc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\cs\Windows 2000.iso .com 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\€ßdc:\program files\common files\microsoft shared\ink\da-dk\Hacking for Dummies.pdf .cpl 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\0æsc:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\Windows 2000.iso .com 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\,]c:\program files\common files\microsoft shared\ink\zh-tw\Hacking and Virus Writing for Dummies.pdf .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\dádc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\ru\Windows XP SP3 REAL VERSION.zip .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\5ÿ[Ëðédc:\program files\common files\microsoft shared\clicktorun\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\0Þsc:\program files\common files\microsoft shared\ink\fr-ca\Windows 2000.iso .com 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\Full warez download sites.html .pif 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\°äsc:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\Windows 2000.iso .com 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\ðâsc:\program files\common files\microsoft shared\ink\nl-nl\Windows 2000.iso .com 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\…ñ[Ë€ìdc:\program files\common files\microsoft shared\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\¥ü[Ë`çdc:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\da-dk\Windows XP SP3 REAL VERSION.zip .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\msinfo\ja-jp\Windows XP SP3 REAL VERSION.zip .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\,]c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\it\Hacking and Virus Writing for Dummies.pdf .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\,]c:\program files\common files\microsoft shared\ink\ja-jp\Hacking and Virus Writing for Dummies.pdf .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\5ÿ[Ëðédc:\program files\common files\microsoft shared\officesoftwareprotectionplatform\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\,]c:\program files\common files\microsoft shared\Hacking and Virus Writing for Dummies.pdf .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program fÿc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\ja\WinAmp 5.08 FULL.zip .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program fÿc:\program files\common files\microsoft shared\ink\el-gr\WinAmp 5.08 FULL.zip .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\0Þsc:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\Windows 2000.iso .com 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\¥ü[Ë`çdc:\program files\common files\microsoft shared\ink\th-th\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\,]c:\program files\common files\microsoft shared\source engine\Hacking and Virus Writing for Dummies.pdf .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\dotnet\shared\microsoft.netcore.app\Windows XP SP3 REAL VERSION.zip .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\¥ü[Ë`çdc:\program files\common files\microsoft shared\ink\uk-ua\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\Fc:\program files\common files\microsoft shared\office16\office setup controller\Visual Studio .NET FULL.zip .cpl 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\ .pifc:\program files\common files\microsoft shared\vsto\Internet Explorer 7 FULL BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\Uú[ËÐädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\tr\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\,]c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\de\Hacking and Virus Writing for Dummies.pdf .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\,]c:\program files\common files\microsoft shared\ink\el-gr\Hacking and Virus Writing for Dummies.pdf .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\¥ü[Ë`çdc:\program files\common files\microsoft shared\ink\fr-ca\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\ßqc:\program files\common files\microsoft shared\triedit\Windows 2000.iso .com 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\¥ü[Ë`çdc:\program files\common files\microsoft shared\vsto\10.0\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\vsto\10.0\Full warez download sites.html .pif 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\5ÿ[Ëðédc:\program files\dotnet\shared\microsoft.netcore.app\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\,]c:\program files\common files\microsoft shared\ink\he-il\Hacking and Virus Writing for Dummies.pdf .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\,]c:\program files\common files\microsoft shared\ink\ko-kr\Hacking and Virus Writing for Dummies.pdf .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\Uú[ËÐädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\cs\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\°àsc:\program files\common files\microsoft shared\ink\hwrcustomization\Windows 2000.iso .com 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\ðàsc:\program files\common files\microsoft shared\vsto\Windows 2000.iso .com 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\¥ü[Ë`çdc:\program files\common files\microsoft shared\ink\fr-fr\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\¥ü[Ë`çdc:\program files\common files\microsoft shared\ink\hr-hr\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\pßsc:\program files\common files\microsoft shared\ink\sl-si\Windows 2000.iso .com 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\program filec:\program files\common files\microsoft shared\msinfo\ja-jp\WinAmp 5.08 FULL.zip .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\°åsc:\program files\common files\microsoft shared\ink\ro-ro\Windows 2000.iso .com 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\Full warez download sites.html .pif 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\vsto\10.0\Hacking for Dummies.pdf .cpl 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\Uú[ËÐädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\ja\WinRAR 4.01 Cracked BETA.exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\Matrix Reloaded.avi .exec:\program files\common files\microsoft shared\ink\bg-bg\Matrix Reloaded.avi .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe File created C:\Users\Admin\AppData\Local\Temp\,]c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\zh-hans\Hacking and Virus Writing for Dummies.pdf .exe 87d88b17ea5fe29ec4d02dff72226d7f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe 3300 87d88b17ea5fe29ec4d02dff72226d7f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87d88b17ea5fe29ec4d02dff72226d7f.exe"C:\Users\Admin\AppData\Local\Temp\87d88b17ea5fe29ec4d02dff72226d7f.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3300 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 31122⤵
- Program crash
PID:1424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3300 -ip 33001⤵PID:4472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5f7d160bcb0304cee21f92792f8e67c16
SHA1995e9744cf2207b382fdbeea336dbcf96ad101a6
SHA25636eb4741cbfa0a704368670be73015bfe1775976ba8b51e303965db6235315ea
SHA512faf03915b855814af471508f368d5c1f16bf967f2a438f4fb54949afe142b1e9e899725aaf6e2079a55fab7d2b1c060ce3592f4e7dc75a5d260fdb4c4fd0e859