Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-03-2024 13:11
Behavioral task
behavioral1
Sample
d3986eca41353e9a5b098e2fc7cd1792.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
d3986eca41353e9a5b098e2fc7cd1792.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
d3986eca41353e9a5b098e2fc7cd1792.exe
-
Size
11.1MB
-
MD5
d3986eca41353e9a5b098e2fc7cd1792
-
SHA1
ea72c60bb41f936bb0d1fa34f194767e9035905c
-
SHA256
8ad6c99f0f5f63bf522293bb6fa4e83690a4b01c79a17de93efc703f491ef30d
-
SHA512
41fbd6add52e002a82c1ebc99b8739f8b4fb82610307cffd5409f0821cac65a9013573ef489261109f801f33105bb9b80ae73809c2be57d657999fa17111dd97
-
SSDEEP
196608:jjBxcO4jj4GD539YoUhjBxcO4jj4GD539YoMSU64sF:z2D53v62D53vMfCF
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS d3986eca41353e9a5b098e2fc7cd1792.exe -
resource yara_rule behavioral1/memory/2352-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/files/0x00010000000104e6-7.dat upx behavioral1/memory/2352-296-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" d3986eca41353e9a5b098e2fc7cd1792.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\DBTASK.EXE d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Windows\SysWOW64\dbzip2.dll d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Windows\SysWOW64\dbexe2.dll d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Windows\SysWOW64\LockFile.dat d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Windows\SysWOW64\DbTasker.exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Windows\SysWOW64\DbTasker.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Windows\SysWOW64\hal.dll d3986eca41353e9a5b098e2fc7cd1792.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files\common files\microsoft shared\ink\da-dk\Internet Explorer 7 FULL BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\da-dk\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\sk-sk\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\triedit\es-es\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\et-ee\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\Internet Explorer 7 FULL BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\hr-hr\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\uk-ua\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Program Files\DVD Maker\DVDMaker.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\th-th\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\ro-ro\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\vsto\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\7-Zip\7zG.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\en-us\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\triedit\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\textconv\en-us\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\vgx\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\nb-no\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\sv-se\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\msinfo\en-us\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\msinfo\ja-jp\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\triedit\fr-fr\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\textconv\en-us\Internet Explorer 7 FULL BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\filters\Internet Explorer 7 FULL BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\filters\NORTON Internet security 2006.rar .scr d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\sr-latn-cs\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\tr-tr\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\web\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\textconv\it-it\Internet Explorer 7 FULL BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\triedit\en-us\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\msinfo\de-de\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\msinfo\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\7-Zip\7z.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Program Files\Internet Explorer\ielowutil.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\es-es\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\ru-ru\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\textconv\fr-fr\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP2 WORKING activation crack.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\bg-bg\NORTON Internet security 2006.rar .scr d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip d3986eca41353e9a5b098e2fc7cd1792.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2528 2352 WerFault.exe 27 -
NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Visual Studio .NET FULL.zip .cpl d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\Bc:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\msinfo\ja-jp\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ .cmdc:\program files\common files\microsoft shared\ink\cs-czc:\program files\common files\microsoft shared\ink\cs-cz\Kazaa Lite 2005 Edition.rar .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\â(c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\åOLulê(c:\program files\common files\microsoft shared\filters\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ shared\textconvc:\program files\common files\microsofc:\program files\common files\microsoft shared\triedit\es-es\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\triedit\en-us\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\el-gc:\program files\common files\microsoft shared\ink\et-ee\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\ink\fsdefinitions\main\Matrix Reloaded.avi .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP3 REAL VERSION.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\åOLuÜç(c:\program files\common files\microsoft shared\ink\en-us\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\êøË Þl eÚc:\program files\common files\microsoft shared\triedit\en-us\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\ink\bg-bg\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\åOLuÜç(c:\program files\common files\microsoft shared\ink\ko-kr\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ÚdÚ0qÝÎÚdÚc:\program files\common files\microsoft shared\triedit\de-de\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\d\Rc:\program files\common files\microsoft shared\filters\Pamela Anderson FULL VIDEO.mpg .scr d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\È8â*ØÖ(c:\program files\common files\microsoft shared\vsto\10.0\1033\Windows XP SECRET DEVELOPER serials.txt .cmd d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\ru-ru\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\1Ê@}j Èâ(c:\program files\common files\microsoft shared\ink\ar-sa\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\3¨ wc:\program files\common files\microsoft shared\ink\ar-sa\Hacking for Dummies.pdf .cpl d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\åOLuÜç(c:\program files\common files\microsoft shared\ink\pl-pl\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\ro-ro\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\textconv\es-es\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\(û wc:\program files\common files\microsoft shared\filters\Visual Studio .NET FULL.zip .cpl d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\files\microsoft shared\ink\fsdefinitions\numbersc:\program files\common files\miöc:\program files\common files\microsoft shared\msinfo\de-de\Visual Studio .NET FULL.zip .cpl d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ shared\textconvc:\program files\common files\microsofc:\program files\common files\microsoft shared\triedit\en-us\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\åOLuÜç(c:\program files\common files\microsoft shared\ink\th-th\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\msinfo\en-us\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\msinfo\it-it\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ä6Rc:\program files\common files\microsoft shared\textconv\en-us\Pamela Anderson FULL VIDEO.mpg .scr d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\vsto\10.0\1033\Playboy centerfold HOT.gif .scr d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\sk-sk\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\åOLuLå(c:\program files\common files\microsoft shared\ink\fsdefinitions\main\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\åOLuÜç(c:\program files\common files\microsoft shared\msinfo\en-us\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\ink\el-gr\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\åOLuÜç(c:\program files\common files\microsoft shared\ink\ru-ru\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\Òà wc:\program files\common files\microsoft shared\textconv\de-de\Windows XP SP3 REAL VERSION.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\nb-nc:\program files\common files\microsoft shared\ink\pt-pt\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\åOLuLå(c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\Bc:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\c:\c:\program files\common files\microsoft shared\triedit\en-us\Windows XP SP3 REAL VERSION.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\1Ê@}j Èâ(c:\program files\common files\microsoft shared\ink\el-gr\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\office14\Visual Studio .NET FULL.zip .cpl d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\uk-ua\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\$1Rc:\program files\common files\microsoft shared\ink\ar-sa\Pamela Anderson FULL VIDEO.mpg .scr d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\&á w ×(c:\program files\common files\microsoft shared\ink\ar-sa\Playboy centerfold HOT.gif .scr d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\Bc:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\|ç(c:\program files\common files\microsoft shared\filters\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\et-ee\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\ink\fsdefinitions\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\åOLuÜç(c:\program files\common files\microsoft shared\ink\pt-pt\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\msinfo\fr-fr\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\triedit\it-it\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\D²Þ*c:\program files\common files\microsoft shared\ink\el-gr\Pamela Anderson FULL VIDEO.mpg .scr d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\h5Kc:\program files\common files\microsoft shared\ink\lv-lv\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\th-th\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ shared\textconvc:\program files\common files\microsofc:\program files\common files\microsoft shared\triedit\fr-fr\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\triedit\it-it\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\|ç(c:\program files\common files\microsoft shared\vc\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\bg-bg\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 2352 d3986eca41353e9a5b098e2fc7cd1792.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2528 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 29 PID 2352 wrote to memory of 2528 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 29 PID 2352 wrote to memory of 2528 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 29 PID 2352 wrote to memory of 2528 2352 d3986eca41353e9a5b098e2fc7cd1792.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3986eca41353e9a5b098e2fc7cd1792.exe"C:\Users\Admin\AppData\Local\Temp\d3986eca41353e9a5b098e2fc7cd1792.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 29802⤵
- Program crash
PID:2528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD586c397930fa2458a88ea3a3c71e36a45
SHA1555afef18d9a8536411dd27df1eda5846ed6b725
SHA256ae9f58ff9c0c1d31f3817be1ac47364d62c11ea8e22ba3b48b4dcfcce1d7090f
SHA512fbbb469b32cd44fde800b955c946b8deea8796740d7f6e590cfae0e87335c00b54a6a4525474d5ba7aa67655f47f966587774a328ef86fb8a4832b4e26994b8b