Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18/03/2024, 13:11
Behavioral task
behavioral1
Sample
d3986eca41353e9a5b098e2fc7cd1792.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
d3986eca41353e9a5b098e2fc7cd1792.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
d3986eca41353e9a5b098e2fc7cd1792.exe
-
Size
11.1MB
-
MD5
d3986eca41353e9a5b098e2fc7cd1792
-
SHA1
ea72c60bb41f936bb0d1fa34f194767e9035905c
-
SHA256
8ad6c99f0f5f63bf522293bb6fa4e83690a4b01c79a17de93efc703f491ef30d
-
SHA512
41fbd6add52e002a82c1ebc99b8739f8b4fb82610307cffd5409f0821cac65a9013573ef489261109f801f33105bb9b80ae73809c2be57d657999fa17111dd97
-
SSDEEP
196608:jjBxcO4jj4GD539YoUhjBxcO4jj4GD539YoMSU64sF:z2D53v62D53vMfCF
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS d3986eca41353e9a5b098e2fc7cd1792.exe -
resource yara_rule behavioral2/memory/1732-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/files/0x0007000000023311-5.dat upx behavioral2/memory/1732-487-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" d3986eca41353e9a5b098e2fc7cd1792.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\hal.dll d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Windows\SysWOW64\DBTASK.EXE d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Windows\SysWOW64\dbzip2.dll d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Windows\SysWOW64\dbexe2.dll d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Windows\SysWOW64\LockFile.dat d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Windows\SysWOW64\DbTasker.exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Windows\SysWOW64\DbTasker.exe d3986eca41353e9a5b098e2fc7cd1792.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files\common files\microsoft shared\msinfo\fr-fr\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\textconv\en-us\DVD Xcopy PRO Illegal Warez.iso .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\ru\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\ko-kr\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\cs\Pamela Anderson FULL VIDEO.mpg .scr d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Windows XP SP3 REAL VERSION.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\msinfo\fr-fr\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\1033\Internet Explorer 7 FULL BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\es\Pamela Anderson FULL VIDEO.mpg .scr d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\7-Zip\7z.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\source engine\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\DVD Xcopy PRO Illegal Warez.iso .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\msinfo\en-us\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\msinfo\es-es\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\source engine\Pamela Anderson FULL VIDEO.mpg .scr d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\vc\Internet Explorer 7 FULL BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\8.0.0\Internet Explorer 7 FULL BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\Internet Explorer 7 FULL BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\Internet Explorer 7 FULL BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\en-us\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\zh-cn\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\msinfo\de-de\Playboy centerfold HOT.gif .scr d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\office16\office setup controller\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\ja\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\insert\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\nb-no\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\uk-ua\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\zh-cn\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\triedit\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\it\Pamela Anderson FULL VIDEO.mpg .scr d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\he-il\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\msinfo\es-es\Pamela Anderson FULL VIDEO.mpg .scr d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\office16\office setup controller\Pamela Anderson FULL VIDEO.mpg .scr d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\tr\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\en-gb\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\textconv\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\msinfo\en-us\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\8.0.0\Pamela Anderson FULL VIDEO.mpg .scr d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\de-de\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\common files\microsoft shared\ink\sv-se\How to stop NetSky.doc .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\Full warez download sites.html .pif d3986eca41353e9a5b098e2fc7cd1792.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip d3986eca41353e9a5b098e2fc7cd1792.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1796 1732 WerFault.exe 93 -
NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\8Xƒc:\program files\common files\microsoft shared\ink\zh-tw\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\è`c:\program files\common files\microsoft shared\ink\ar-sa\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]Mv¼çdc:\program files\common files\microsoft shared\msinfo\es-es\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program ÿc:\program files\common files\microsoft shared\msinfo\fr-fr\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\cs-cz\Windows XP SP3 REAL VERSION.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\Internet Explorer 7 FULL BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]Mv¼çdc:\program files\common files\microsoft shared\ink\bg-bg\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\lv-lv\Windows XP SP3 REAL VERSION.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]Mv¼çdc:\program files\common files\microsoft shared\ink\pt-pt\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ ·c:\program files\common files\microsoft shared\triedit\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\+c:\program files\common files\microsoft shared\vsto\10.0\1033\Matrix Reloaded.avi .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ŵpñ`çdc:\program files\common files\microsoft shared\ink\ko-kr\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\vsto\Hacking for Dummies.pdf .cpl d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ŵpñ`çdc:\program files\common files\microsoft shared\ink\nb-no\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\¨nc:\program files\common files\microsoft shared\ink\fsdefinitions\main\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program fÿc:\program files\common files\microsoft shared\ink\zh-cn\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\7c:\program files\common files\microsoft shared\office16\office setup controller\Visual Studio .NET FULL.zip .cpl d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ ¶c:\program files\common files\microsoft shared\vsto\10.0\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\8Xƒc:\program files\common files\microsoft shared\ink\sr-latn-rs\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\U¶pñðédc:\program files\common files\microsoft shared\officesoftwareprotectionplatform\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\textconv\Visual Studio .NET FULL.zip .cpl d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\5³pñÐädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\it\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ ‹„c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\ko\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]Mv,ådc:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ .cmdc:\program files\common files\microsoft shared\vsto\10.0\Playboy centerfold HOT.gif .scr d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ .pifc:\program files\common files\microsoft shared\textconv\Internet Explorer 7 FULL BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\€ßdc:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\Hacking for Dummies.pdf .cpl d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]Mv,ådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\zh-hans\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\(oc:\program files\common files\microsoft shared\ink\fi-fi\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]Mv,ådc:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\hgc:\program files\common files\microsoft shared\ink\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]Mv¼çdc:\program files\common files\microsoft shared\msinfo\it-it\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\Ðc:\program files\common files\microsoft shared\textconv\en-us\Windows XP SP3 REAL VERSION.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ ·c:\program files\dotnet\shared\microsoft.netcore.app\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\es\Matrix Reloaded.avi .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ .cmdc:\program files\common files\microsoft shared\ink\ar-sa\HalfLife 2 WORKING Steam Activation crack.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ŵpñ`çdc:\program files\common files\microsoft shared\ink\languagemodel\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created \??\c:\program fÿc:\program files\common files\microsoft shared\ink\lt-lt\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\`ˆ„c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\fr\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\hkc:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]Mv,ådc:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]Mv¼çdc:\program files\common files\microsoft shared\ink\languagemodel\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\office16\office setup controller\Windows XP SP3 REAL VERSION.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ŵpñ`çdc:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\èlc:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]Mv,ådc:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\¨jc:\program files\common files\microsoft shared\ink\hr-hr\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\8Xƒc:\program files\common files\microsoft shared\ink\zh-cn\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]Mv¼çdc:\program files\common files\microsoft shared\msinfo\ja-jp\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\U¶pñðédc:\program files\common files\microsoft shared\vc\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\Matrix Reloaded.avi .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ .cmdc:\program files\common files\microsoft shared\ink\cs-czc:\program files\common files\microsoft shared\ink\cs-cz\Kazaa Lite 2005 Edition.rar .pif d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ŵpñ`çdc:\program files\common files\microsoft shared\ink\es-mx\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]Mv¼çdc:\program files\common files\microsoft shared\ink\cs-cz\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\¨jc:\program files\common files\microsoft shared\ink\lt-lt\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]MvLêdc:\program files\common files\microsoft shared\triedit\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\`“„c:\program files\common files\microsoft shared\vsto\10.0\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]MvÜìdc:\program files\common files\microsoft shared\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\hnc:\program files\common files\microsoft shared\ink\en-us\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\€ßdc:\program files\common files\microsoft shared\msinfo\it-it\Hacking for Dummies.pdf .cpl d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\U¶pñðédc:\program files\common files\microsoft shared\textconv\WinRAR 4.01 Cracked BETA.exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\ ·c:\program files\common files\microsoft shared\vsto\WinAmp 5.08 FULL.zip .exe d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\èfc:\program files\common files\microsoft shared\Windows 2000.iso .com d3986eca41353e9a5b098e2fc7cd1792.exe File created C:\Users\Admin\AppData\Local\Temp\,]Mv,ådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\ru\Hacking and Virus Writing for Dummies.pdf .exe d3986eca41353e9a5b098e2fc7cd1792.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe 1732 d3986eca41353e9a5b098e2fc7cd1792.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3986eca41353e9a5b098e2fc7cd1792.exe"C:\Users\Admin\AppData\Local\Temp\d3986eca41353e9a5b098e2fc7cd1792.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1732 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 27882⤵
- Program crash
PID:1796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1732 -ip 17321⤵PID:2356
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2432,i,12161922670941700748,3348345705955601576,262144 --variations-seed-version /prefetch:81⤵PID:2204
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5ca1d9299be82c00375520d270d3d891b
SHA10d7b6b39522d681a293bd0f0d6d6092951b02641
SHA256232f3c53017073e00790b7f92fbdc36a63ca7efc8ac969973b96c4faa70dc383
SHA5129edda505360c60c0c34575df2af87181a804231c6e1ec6df849b5d2b3d13ba7423372fc3efbf142c71a864196e6de690ad9cf0a701bd9e943a818164cd9ede4a