Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
15-03-2024 14:25
Behavioral task
behavioral1
Sample
cba443c5928796b02d3eb25973b20655.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
cba443c5928796b02d3eb25973b20655.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
cba443c5928796b02d3eb25973b20655.exe
-
Size
4.7MB
-
MD5
cba443c5928796b02d3eb25973b20655
-
SHA1
d675c11f4207ac0e10486b3c916941d0d28a9cd3
-
SHA256
98294eee1e99905752521045e5dc642066e9c354b29adae2446834704232362f
-
SHA512
a9c89aa34ab75c6ff1843d7ee2a44681fa0b68e75feca7ff62046e4a55e9e89bb4b33dc4e5d41a1302fe6a0247b2bd8039cd93fa71019f35e686b46da96b8ec4
-
SSDEEP
49152:jj9LxcO4Q5YTj1I8boQhfD6UDvxvykXk1rBsgyegFKvc4clwYcKfwY0wwvbO5gM:jjBxcO4EYTj3DmfKBOYgM
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS cba443c5928796b02d3eb25973b20655.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS cba443c5928796b02d3eb25973b20655.exe -
resource yara_rule behavioral1/memory/2936-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/files/0x002d000000010624-7.dat upx behavioral1/memory/2936-405-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" cba443c5928796b02d3eb25973b20655.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\DBTASK.EXE cba443c5928796b02d3eb25973b20655.exe File created C:\Windows\SysWOW64\dbzip2.dll cba443c5928796b02d3eb25973b20655.exe File created C:\Windows\SysWOW64\dbexe2.dll cba443c5928796b02d3eb25973b20655.exe File created C:\Windows\SysWOW64\LockFile.dat cba443c5928796b02d3eb25973b20655.exe File created C:\Windows\SysWOW64\DbTasker.exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Windows\SysWOW64\DbTasker.exe cba443c5928796b02d3eb25973b20655.exe File created C:\Windows\SysWOW64\hal.dll cba443c5928796b02d3eb25973b20655.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\textconv\ja-jp\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\triedit\en-us\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\hu-hu\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\WinAmp 5.08 FULL.zip u·v â98æ(c:\program files\common files\microsoft shared\ink\ja-jp\WinAmp 5.08 FULL.zip .exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\7-Zip\7zG.exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\bg-bg\Internet Explorer 7 FULL BETA.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\da-dk\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\zh-tw\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\textconv\it-it\Internet Explorer 7 FULL BETA.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\textconv\en-us\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Program Files\Internet Explorer\iexplore.exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\Windows XP SP3 REAL VERSION.zip .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\numbers\WinAmp 5.08 FULL.zip .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\Internet Explorer 7 FULL BETA.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\Windows XP SP3 REAL VERSION.zip .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\ro-ro\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\ru-ru\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\msinfo\it-it\Internet Explorer 7 FULL BETA.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\stationery\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\office14\cultures\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\Internet Explorer 7 FULL BETA.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\Full warez download sites.html .pif cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\WinAmp 5.08 FULL.zip .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\web\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\vc\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\filters\Internet Explorer 7 FULL BETA.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\numbers\Windows XP SP3 REAL VERSION.zip .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Pamela Anderson FULL VIDEO.mpg .scr cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\msinfo\ja-jp\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\filters\Norton AntiVirus 2006 BETA.rar .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\msinfo\fr-fr\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\triedit\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\textconv\de-de\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\msinfo\de-de\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\en-us\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\numbers\Full warez download sites.html .pif cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\triedit\es-es\How to stop NetSky.doc .exe cba443c5928796b02d3eb25973b20655.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip cba443c5928796b02d3eb25973b20655.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2200 2936 WerFault.exe 27 -
NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\¬æc:\program files\càæ(c:\program files\common files\microsoft shared\ink\pt-br\Windows 2000.iso .com cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\pt-pt\WinRAR 4.01 Cracked BETA.exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\åOSvÜç(c:\program files\common files\microsoft shared\triedit\ja-jp\Hacking and Virus Writing for Dummies.pdf .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\ink\fsdefinitions\main\Matrix Reloaded.avi .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\åOSvÜç(c:\program files\common files\microsoft shared\ink\he-il\Hacking and Virus Writing for Dummies.pdf .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\ko-kr\WinAmp 5.08 FULL.zip .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\ko-kr\WinAmp 5.08 FULL.zip u·v â98æ(c:\program files\common files\microsoft shared\ink\lv-lv\WinAmp 5.08 FULL.zip .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\textconv\it-it\WinRAR 4.01 Cracked BETA.exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\`ç(c:\program files\common files\microsoft shared\ink\ar-sa\WinAmp 5.08 FULL.zip .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\åOSvÜç(c:\program files\common files\microsoft shared\ink\zh-cn\Hacking and Virus Writing for Dummies.pdf .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\n files\microsoft shared\ink\fsdefinitions\numbersc:\program files\common files\öc:\program files\common files\microsoft shared\msinfo\de-de\Visual Studio .NET FULL.zip .cpl cba443c5928796b02d3eb25973b20655.exe File created C:\‡uc:\program files\common files\microsoft shared\msinfo\it-it\Pamela Anderson FULL VIDEO.mpg .scr cba443c5928796b02d3eb25973b20655.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\WinAmp 5.08 FULL.zip u·v â98æ(c:\program files\common files\microsoft shared\ink\ja-jp\WinAmp 5.08 FULL.zip .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\ro-ro\WinRAR 4.01 Cracked BETA.exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\sk-sk\WinRAR 4.01 Cracked BETA.exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\é"Ú õÊæé"Úc:\program files\common files\microsoft shared\triedit\de-de\Full warez download sites.html .pif cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\$â(c:\program files\common files\microsoft shared\ink\ar-sa\NORTON Internet security 2006.rar .scr cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\cs-cz\WinAmp 5.08 FULL.zip u·v â98æ(c:\program files\common files\microsoft shared\ink\de-de\WinAmp 5.08 FULL.zip .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ðÒ(c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Visual Studio .NET FULL.zip .cpl cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ual Studio .NET FULL.zip .cplc:\pru·v â98æ(c:\program files\common files\microsoft shared\ink\hu-hu\WinAmp 5.08 FULL.zip .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\|ç(c:\program files\common files\microsoft shared\vgx\WinRAR 4.01 Cracked BETA.exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP3 REAL VERSION.zip .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\sk-sk\WinAmp 5.08 FULL.zip u·v â98æ(c:\program files\common files\microsoft shared\ink\sr-latn-cs\WinAmp 5.08 FULL.zip .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\¬æc:\program files\càæ(c:\program files\common files\microsoft shared\ink\sv-se\Windows 2000.iso .com cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\¬æc:\program files\càæ(c:\program files\common files\microsoft shared\ink\zh-tw\Windows 2000.iso .com cba443c5928796b02d3eb25973b20655.exe File created C:\â(c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\WinRAR 4.01 Cracked BETA.exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ äc:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\Windows 2000.iso .com cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\[sc:\program files\àæ(c:\program files\common files\microsoft shared\msinfo\es-es\Windows 2000.iso .com cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\stationery\Windows XP SP3 REAL VERSION.zip .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\åOSvÜç(c:\program files\common files\microsoft shared\ink\bg-bg\Hacking and Virus Writing for Dummies.pdf .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\$â(c:\program files\common files\microsoft shared\ink\bg-bg\NORTON Internet security 2006.rar .scr cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\h5mc:\program files\àæ(c:\program files\common files\microsoft shared\ink\et-ee\Windows 2000.iso .com cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ äc:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\Windows 2000.iso .com cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\é"Ú õÊæé"Úc:\program files\common files\microsoft shared\textconv\de-de\Full warez download sites.html .pif cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ê"ÚÐêc:\program files\common files\microsoft shared\triedit\es-es\Full warez download sites.html .pif cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\&áÙw ×(c:\program files\common files\microsoft shared\office14\cultures\Playboy centerfold HOT.gif .scr cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ ˆuc:\program files\common files\microsoft shared\textconv\de-de\Pamela Anderson FULL VIDEO.mpg .scr cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\åOSvÜç(c:\program files\common files\microsoft shared\textconv\it-it\Hacking and Virus Writing for Dummies.pdf .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\el-gr\WinAmp 5.08 FULL.zip u·v â98æ(c:\program files\common files\microsoft shared\ink\es-es\WinAmp 5.08 FULL.zip .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\åOSvÜç(c:\program files\common files\microsoft shared\ink\hwrcustomization\Hacking and Virus Writing for Dummies.pdf .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\h5mc:\program files\àæ(c:\program files\common files\microsoft shared\ink\hwrcustomization\Windows 2000.iso .com cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\msinfo\de-de\WinRAR 4.01 Cracked BETA.exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\sk-sk\WinAmp 5.08 FULL.zip u·v â98æ(c:\program files\common files\microsoft shared\ink\sl-si\WinAmp 5.08 FULL.zip .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\åOSvÜç(c:\program files\common files\microsoft shared\msinfo\de-de\Hacking and Virus Writing for Dummies.pdf .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\åOSvÜç(c:\program files\common files\microsoft shared\msinfo\en-us\Hacking and Virus Writing for Dummies.pdf .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\office14\Visual Studio .NET FULL.zip .cpl cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\(ûÙwc:\program files\common files\microsoft shared\filters\Visual Studio .NET FULL.zip .cpl cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\&áÙw ×(c:\program files\common files\microsoft shared\ink\ar-sa\Playboy centerfold HOT.gif .scr cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\ink\el-gr\Windows XP SP3 REAL VERSION.zip .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\h5mc:\program files\àæ(c:\program files\common files\microsoft shared\ink\es-es\Windows 2000.iso .com cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\êøËÀ\ –(#Úc:\program files\common files\microsoft shared\triedit\en-us\Full warez download sites.html .pif cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\œŠuc:\program files\common files\microsoft shared\textconv\it-it\Pamela Anderson FULL VIDEO.mpg .scr cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\triedit\de-de\WinRAR 4.01 Cracked BETA.exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\da-dk\WinRAR 4.01 Cracked BETA.exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\åOSvLå(c:\program files\common files\microsoft shared\ink\fsdefinitions\numbers\Hacking and Virus Writing for Dummies.pdf .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\h5mc:\program files\àæ(c:\program files\common files\microsoft shared\ink\hu-hu\Windows 2000.iso .com cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\uk-ua\WinRAR 4.01 Cracked BETA.exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\åOSvÜç(c:\program files\common files\microsoft shared\msinfo\fr-fr\Hacking and Virus Writing for Dummies.pdf .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\textconv\de-de\WinRAR 4.01 Cracked BETA.exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ÒàÙw܇uc7c:\program files\common files\microsoft shared\textconv\en-us\Windows XP SP3 REAL VERSION.zip .exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\À‡uc:\program files\common files\microsoft shared\triedit\de-de\Windows 2000.iso .com cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\hu-hu\WinRAR 4.01 Cracked BETA.exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\hwrcustomization\WinRAR 4.01 Cracked BETA.exe cba443c5928796b02d3eb25973b20655.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\tr-tr\WinAmp 5.08 FULL.zip u·v â98æ(c:\program files\common files\microsoft shared\ink\zh-cn\WinAmp 5.08 FULL.zip .exe cba443c5928796b02d3eb25973b20655.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe 2936 cba443c5928796b02d3eb25973b20655.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2200 2936 cba443c5928796b02d3eb25973b20655.exe 28 PID 2936 wrote to memory of 2200 2936 cba443c5928796b02d3eb25973b20655.exe 28 PID 2936 wrote to memory of 2200 2936 cba443c5928796b02d3eb25973b20655.exe 28 PID 2936 wrote to memory of 2200 2936 cba443c5928796b02d3eb25973b20655.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\cba443c5928796b02d3eb25973b20655.exe"C:\Users\Admin\AppData\Local\Temp\cba443c5928796b02d3eb25973b20655.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 32282⤵
- Program crash
PID:2200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.8MB
MD57f32b7504ebb18cf28be552e1ffd47ab
SHA1bf88fa1092130d8b0c8c41d2a138e08a065d8140
SHA2569e3ad5deff20ca09d5ab9138997199624adf38f5299192c5de5a63fffe819ece
SHA512401af1a53cc02001fd4c69bbe3ea8ddc42c2a81e8ccfac73ed8c0d6f1dff7dddaf273941ef1fbf6ce3cbfe9bbfc688d38f09d380f5b1d60d6f9b127502fda7da