8ad6c99f0f5f63bf522293bb6fa4e83690a4b01c79a17de93efc703f491ef30d

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 13:11 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3986eca41353e9a5b098e2fc7cd1792.exe
Size

11.1MB
MD5

d3986eca41353e9a5b098e2fc7cd1792
SHA1

ea72c60bb41f936bb0d1fa34f194767e9035905c
SHA256

8ad6c99f0f5f63bf522293bb6fa4e83690a4b01c79a17de93efc703f491ef30d
SHA512

41fbd6add52e002a82c1ebc99b8739f8b4fb82610307cffd5409f0821cac65a9013573ef489261109f801f33105bb9b80ae73809c2be57d657999fa17111dd97
SSDEEP

196608:jjBxcO4jj4GD539YoUhjBxcO4jj4GD539YoMSU64sF:z2D53v62D53vMfCF

Score

8^/10

persistence upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Drivers\ETC\HOSTS	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS	d3986eca41353e9a5b098e2fc7cd1792.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2352-0-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/files/0x00010000000104e6-7.dat	upx
behavioral1/memory/2352-296-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe"	d3986eca41353e9a5b098e2fc7cd1792.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DBTASK.EXE	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Windows\SysWOW64\dbzip2.dll	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Windows\SysWOW64\dbexe2.dll	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Windows\SysWOW64\LockFile.dat	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Windows\SysWOW64\DbTasker.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Windows\SysWOW64\DbTasker.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Windows\SysWOW64\hal.dll	d3986eca41353e9a5b098e2fc7cd1792.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\program files\common files\microsoft shared\ink\da-dk\Internet Explorer 7 FULL BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\da-dk\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\sk-sk\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\triedit\es-es\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\et-ee\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\el-gr\Internet Explorer 7 FULL BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\hr-hr\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\uk-ua\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\th-th\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\el-gr\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ro-ro\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\vsto\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\cs-cz\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\en-us\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\triedit\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\textconv\en-us\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\vgx\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\nb-no\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\sv-se\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\Full warez download sites.html .pif	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\en-us\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\ja-jp\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\triedit\fr-fr\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\textconv\en-us\Internet Explorer 7 FULL BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\filters\Internet Explorer 7 FULL BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\filters\NORTON Internet security 2006.rar .scr	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\sr-latn-cs\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\tr-tr\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\web\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\textconv\it-it\Internet Explorer 7 FULL BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\triedit\en-us\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\de-de\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\es-es\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ru-ru\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\textconv\fr-fr\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP2 WORKING activation crack.zip .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\bg-bg\NORTON Internet security 2006.rar .scr	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\How to stop NetSky.doc .exe	d3986eca41353e9a5b098e2fc7cd1792.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\WinTask.zip	d3986eca41353e9a5b098e2fc7cd1792.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	2352	WerFault.exe	27

NTFS ADS 64 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Visual Studio .NET FULL.zip .cpl	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\Bc:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\WinAmp 5.08 FULL.zip .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\msinfo\ja-jp\Windows 2000.iso .com	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .cmdc:\program files\common files\microsoft shared\ink\cs-czc:\program files\common files\microsoft shared\ink\cs-cz\Kazaa Lite 2005 Edition.rar .pif	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\â(c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\WinRAR 4.01 Cracked BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\åOLulê(c:\program files\common files\microsoft shared\filters\Hacking and Virus Writing for Dummies.pdf .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\Windows 2000.iso .com	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ shared\textconvc:\program files\common files\microsofc:\program files\common files\microsoft shared\triedit\es-es\WinAmp 5.08 FULL.zip .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\triedit\en-us\Windows 2000.iso .com	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\el-gc:\program files\common files\microsoft shared\ink\et-ee\WinAmp 5.08 FULL.zip .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\ink\fsdefinitions\main\Matrix Reloaded.avi .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP3 REAL VERSION.zip .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\åOLuÜç(c:\program files\common files\microsoft shared\ink\en-us\Hacking and Virus Writing for Dummies.pdf .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\êøË Þl eÚc:\program files\common files\microsoft shared\triedit\en-us\Full warez download sites.html .pif	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\ink\bg-bg\Windows 2000.iso .com	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\åOLuÜç(c:\program files\common files\microsoft shared\ink\ko-kr\Hacking and Virus Writing for Dummies.pdf .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ÚdÚ0qÝÎÚdÚc:\program files\common files\microsoft shared\triedit\de-de\Full warez download sites.html .pif	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\d\Rc:\program files\common files\microsoft shared\filters\Pamela Anderson FULL VIDEO.mpg .scr	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\È8â*ØÖ(c:\program files\common files\microsoft shared\vsto\10.0\1033\Windows XP SECRET DEVELOPER serials.txt .cmd	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\ru-ru\WinAmp 5.08 FULL.zip .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\1Ê@}j Èâ(c:\program files\common files\microsoft shared\ink\ar-sa\Full warez download sites.html .pif	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\3¨wc:\program files\common files\microsoft shared\ink\ar-sa\Hacking for Dummies.pdf .cpl	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\åOLuÜç(c:\program files\common files\microsoft shared\ink\pl-pl\Hacking and Virus Writing for Dummies.pdf .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\ro-ro\WinRAR 4.01 Cracked BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\textconv\es-es\WinRAR 4.01 Cracked BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\(û wc:\program files\common files\microsoft shared\filters\Visual Studio .NET FULL.zip .cpl	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\files\microsoft shared\ink\fsdefinitions\numbersc:\program files\common files\miöc:\program files\common files\microsoft shared\msinfo\de-de\Visual Studio .NET FULL.zip .cpl	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ shared\textconvc:\program files\common files\microsofc:\program files\common files\microsoft shared\triedit\en-us\WinAmp 5.08 FULL.zip .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\åOLuÜç(c:\program files\common files\microsoft shared\ink\th-th\Hacking and Virus Writing for Dummies.pdf .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\msinfo\en-us\WinRAR 4.01 Cracked BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\msinfo\it-it\WinRAR 4.01 Cracked BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ä6Rc:\program files\common files\microsoft shared\textconv\en-us\Pamela Anderson FULL VIDEO.mpg .scr	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\vsto\10.0\1033\Playboy centerfold HOT.gif .scr	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\sk-sk\WinRAR 4.01 Cracked BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\åOLuLå(c:\program files\common files\microsoft shared\ink\fsdefinitions\main\Hacking and Virus Writing for Dummies.pdf .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\åOLuÜç(c:\program files\common files\microsoft shared\msinfo\en-us\Hacking and Virus Writing for Dummies.pdf .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\ink\el-gr\Windows 2000.iso .com	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\åOLuÜç(c:\program files\common files\microsoft shared\ink\ru-ru\Hacking and Virus Writing for Dummies.pdf .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\Òà wc:\program files\common files\microsoft shared\textconv\de-de\Windows XP SP3 REAL VERSION.zip .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\nb-nc:\program files\common files\microsoft shared\ink\pt-pt\WinAmp 5.08 FULL.zip .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\åOLuLå(c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Hacking and Virus Writing for Dummies.pdf .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Windows 2000.iso .com	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\Bc:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\WinAmp 5.08 FULL.zip .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\c:\program files\common files\microsoft shared\triedit\en-us\Windows XP SP3 REAL VERSION.zip .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\1Ê@}j Èâ(c:\program files\common files\microsoft shared\ink\el-gr\Full warez download sites.html .pif	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\office14\Visual Studio .NET FULL.zip .cpl	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\uk-ua\WinRAR 4.01 Cracked BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\$1Rc:\program files\common files\microsoft shared\ink\ar-sa\Pamela Anderson FULL VIDEO.mpg .scr	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\&á w ×(c:\program files\common files\microsoft shared\ink\ar-sa\Playboy centerfold HOT.gif .scr	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\Bc:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\WinAmp 5.08 FULL.zip .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\\|ç(c:\program files\common files\microsoft shared\filters\WinRAR 4.01 Cracked BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\et-ee\WinRAR 4.01 Cracked BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\Full warez download sites.html .pif	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\ink\fsdefinitions\Windows 2000.iso .com	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\åOLuÜç(c:\program files\common files\microsoft shared\ink\pt-pt\Hacking and Virus Writing for Dummies.pdf .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\msinfo\fr-fr\WinRAR 4.01 Cracked BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\triedit\it-it\Windows 2000.iso .com	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\D²Þ*c:\program files\common files\microsoft shared\ink\el-gr\Pamela Anderson FULL VIDEO.mpg .scr	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\ink\lv-lv\Windows 2000.iso .com	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\th-th\WinAmp 5.08 FULL.zip .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ shared\textconvc:\program files\common files\microsofc:\program files\common files\microsoft shared\triedit\fr-fr\WinAmp 5.08 FULL.zip .exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\triedit\it-it\WinRAR 4.01 Cracked BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\\|ç(c:\program files\common files\microsoft shared\vc\WinRAR 4.01 Cracked BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\bg-bg\WinRAR 4.01 Cracked BETA.exe	d3986eca41353e9a5b098e2fc7cd1792.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe
2352	d3986eca41353e9a5b098e2fc7cd1792.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2528	2352	d3986eca41353e9a5b098e2fc7cd1792.exe	29
PID 2352 wrote to memory of 2528	2352	d3986eca41353e9a5b098e2fc7cd1792.exe	29
PID 2352 wrote to memory of 2528	2352	d3986eca41353e9a5b098e2fc7cd1792.exe	29
PID 2352 wrote to memory of 2528	2352	d3986eca41353e9a5b098e2fc7cd1792.exe	29

C:\Users\Admin\AppData\Local\Temp\d3986eca41353e9a5b098e2fc7cd1792.exe
"C:\Users\Admin\AppData\Local\Temp\d3986eca41353e9a5b098e2fc7cd1792.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 2980
  2⤵
  - Program crash
  PID:2528

Network

DNS

www.crackedmindstechnologies.com

d3986eca41353e9a5b098e2fc7cd1792.exe

Remote address:

8.8.8.8:53

Request

www.crackedmindstechnologies.com

IN A

Response
DNS

Remote address:

8.8.8.8:53

Request

IN MX

Response
DNS

Remote address:

8.8.8.8:53

Request

IN MX
DNS

Remote address:

8.8.8.8:53

Request

IN MX

Response
DNS

fabrikam.com

d3986eca41353e9a5b098e2fc7cd1792.exe

Remote address:

8.8.8.8:53

Request

fabrikam.com

IN MX

Response

fabrikam.com

IN MX

mail�
DNS

mail.fabrikam.com

d3986eca41353e9a5b098e2fc7cd1792.exe

Remote address:

8.8.8.8:53

Request

mail.fabrikam.com

IN A

Response

mail.fabrikam.com

IN A

131.107.55.31
DNS

mail.fabrikam.com

d3986eca41353e9a5b098e2fc7cd1792.exe

Remote address:

8.8.8.8:53

Request

mail.fabrikam.com

IN A
DNS

mail.fabrikam.com

d3986eca41353e9a5b098e2fc7cd1792.exe

Remote address:

8.8.8.8:53

Request

mail.fabrikam.com

IN A

Response

mail.fabrikam.com

IN A

131.107.55.31

131.107.55.31:25

mail.fabrikam.com

d3986eca41353e9a5b098e2fc7cd1792.exe

152 B
3

8.8.8.8:53

www.crackedmindstechnologies.com

dns

d3986eca41353e9a5b098e2fc7cd1792.exe

78 B
151 B
1
1

DNS Request

www.crackedmindstechnologies.com
8.8.8.8:53

dns

92 B
120 B
2
1

DNS Request

DNS Request
8.8.8.8:53

dns

46 B
120 B
1
1

DNS Request
8.8.8.8:53

fabrikam.com

dns

d3986eca41353e9a5b098e2fc7cd1792.exe

58 B
79 B
1
1

DNS Request

fabrikam.com
8.8.8.8:53

mail.fabrikam.com

dns

d3986eca41353e9a5b098e2fc7cd1792.exe

126 B
79 B
2
1

DNS Request

mail.fabrikam.com

DNS Request

mail.fabrikam.com

DNS Response

131.107.55.31
8.8.8.8:53

mail.fabrikam.com

dns

d3986eca41353e9a5b098e2fc7cd1792.exe

63 B
79 B
1
1

DNS Request

mail.fabrikam.com

DNS Response

131.107.55.31

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
4.2MB

MD5
86c397930fa2458a88ea3a3c71e36a45

SHA1
555afef18d9a8536411dd27df1eda5846ed6b725

SHA256
ae9f58ff9c0c1d31f3817be1ac47364d62c11ea8e22ba3b48b4dcfcce1d7090f

SHA512
fbbb469b32cd44fde800b955c946b8deea8796740d7f6e590cfae0e87335c00b54a6a4525474d5ba7aa67655f47f966587774a328ef86fb8a4832b4e26994b8b

Download Submit
memory/2352-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2352-296-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.