761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563

Analysis

max time kernel
135s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
Size

9.3MB
MD5

a2506f486059dbab22a8d70e74c73e7d
SHA1

883ff6c6dd24d5958ea14a458993eaaddd6cbffb
SHA256

761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563
SHA512

da3b25ddba64bd36b7c2f8b116b72ea988eaf57efd726270a391cabadafb998da16e23fa660ecff48dfae8f92087f40ea0d3dc086cf9daa2f9e661afd9457ae3
SSDEEP

196608:5xz51LZLi3m38NuPyRqhhhIHVE24f6N1Ii:5xz519LmNuPyqhU1E24A/

Score

8^/10

persistence upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File opened for modification	C:\Windows\system32\Drivers\ETC\HOSTS	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/392-0-0x0000000000400000-0x0000000000D20000-memory.dmp	upx
behavioral2/memory/392-2-0x0000000000400000-0x0000000000D20000-memory.dmp	upx
behavioral2/memory/392-3-0x0000000000400000-0x0000000000D20000-memory.dmp	upx
behavioral2/files/0x000a000000023195-8.dat	upx
behavioral2/memory/392-446-0x0000000000400000-0x0000000000D20000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe"	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DbTasker.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File opened for modification	C:\Windows\SysWOW64\DbTasker.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Windows\SysWOW64\hal.dll	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Windows\SysWOW64\DBTASK.EXE	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Windows\SysWOW64\dbzip2.dll	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Windows\SysWOW64\dbexe2.dll	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Windows\SysWOW64\LockFile.dat	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\program files\common files\microsoft shared\msinfo\ja-jp\Pamela Anderson FULL VIDEO.mpg .scr	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\DVD Xcopy PRO Illegal Warez.iso .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\es-es\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\WinAmp 5.08 FULL.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Windows XP SP3 REAL VERSION.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\cs-cz\WinAmp 5.08 FULL.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\da-dk\Full warez download sites.html .pif	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\zh-cn\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\vsto\10.0\1033\DVD Xcopy PRO Illegal Warez.iso .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\vsto\10.0\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\de\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\zh-hans\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\office16\office setup controller\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\stationery\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\vsto\Pamela Anderson FULL VIDEO.mpg .scr	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\cs\Pamela Anderson FULL VIDEO.mpg .scr	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\vsto\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\bg-bg\Full warez download sites.html .pif	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\de-de\Playboy centerfold HOT.gif .scr	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\NORTON Inte c:\program files\common files\microsoft shared\ink\bg-bg\NORTON Internet security 2006.rar .scr	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\tr-tr\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\WinAmp 5.08 FULL.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\it-it\Full warez download sites.html .pif	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\vsto\10.0\1033\Internet Explorer 7 FULL BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\clicktorun\HalfLife 2 WORKING Steam Activation crack.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Full warez download sites.html .pif	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\hr-hr\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\en-us\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fr-fr\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\textconv\en-us\DVD Xcopy PRO Illegal Warez.iso .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\source engine\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\insert\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\pl-pl\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\fr-fr\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\vc\Full warez download sites.html .pif	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\Pamela Anderson FULL VIDEO.mpg .scr	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\cs\Internet Explorer 7 FULL BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\it\Full warez download sites.html .pif	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\da-dk\Pamela Anderson FULL VIDEO.mpg .scr	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\office16\office setup controller\Full warez download sites.html .pif	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\source engine\Full warez download sites.html .pif	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ru-ru\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\sk-sk\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\vc\How to stop NetSky.doc .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\cs-cz\Pamela Anderson FULL VIDEO.mpg .scr	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\WinAmp 5.08 FULL.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\vsto\10.0\1033\WinAmp 5.08 FULL.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\Full warez download sites.html .pif	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\vsto\10.0\1033\Pamela Anderson FULL VIDEO.mpg .scr	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\WinTask.zip	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4960	392	WerFault.exe	87

NTFS ADS 64 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\þÿÿÿXâñc:\program files\common files\microsoft shared\clicktorun\Hacking for Dummies.pdf .cpl	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]Êu¼çñc:\program files\common files\microsoft shared\ink\cs-cz\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ý!’½`çñc:\program files\common files\microsoft shared\ink\fi-fi\WinRAR 4.01 Cracked BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]Êu,åñc:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\common files\microsoft shared\triedit\Pamela Anderson FULL VIDEO.mpg .scr	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\ec:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SECRET DEVELOPER serials.txt .cmd	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\triedit\en-us\Windows XP SP3 REAL VERSION.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .pifc:\program files\common files\microsoft shared\Internet Explorer 7 FULL BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ý!’½`çñc:\program files\common files\microsoft shared\ink\th-th\WinRAR 4.01 Cracked BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]Êu¼çñc:\program files\common files\microsoft shared\office16\office setup controller\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\;½ÿhþÿÿÿ¤Öñc:\program files\common files\microsoft shared\vsto\10.0\1033\Windows XP SECRET DEVELOPER serials.txt .cmd	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\ c:\program files\dotnet\shared\microsoft.netcore.app\WinAmp 5.08 FULL.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\-'’½Ðäñc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\es\WinRAR 4.01 Cracked BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\„æñc:\program files\common files\microsoft shared\clicktorun\Windows XP SP3 REAL VERSION.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ý!’½`çñc:\program files\common files\microsoft shared\ink\pl-pl\WinRAR 4.01 Cracked BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\È+ý*c:\program files\common files\microsoft shared\ink\zh-tw\Windows 2000.iso .com	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\€ßñc:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\Hacking for Dummies.pdf .cpl	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\ôãñc:\program files\common files\microsoft shared\ink\es-es\Windows XP SP3 REAL VERSION.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\Matrix Reloaded.avi .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\Full warez download sites.html .pif	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\Internet Explorer 7 FULL BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\ðÜñc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\es\Hacking for Dummies.pdf .cpl	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]Êu¼çñc:\program files\common files\microsoft shared\ink\da-dk\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]Êu¼çñc:\program files\common files\microsoft shared\ink\ko-kr\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\ forc:\program files\common files\microsoft shared\office16\WinAmp 5.08 FULL.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\'ý*c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\es\Windows 2000.iso .com	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]Êu,åñc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\ko\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\-ý*c:\program files\common files\microsoft shared\msinfo\ja-jp\Windows 2000.iso .com	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\P†ýc:\program files\common files\microsoft shared\ink\bg-bg\Windows 2000.iso .com	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]Êu¼çñc:\program files\common files\microsoft shared\ink\en-us\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\‰ýc:\program files\common files\microsoft shared\ink\fi-fi\Windows 2000.iso .com	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\çc:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Visual Studio .NET FULL.zip .cpl	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\È+ý*c:\program files\common files\microsoft shared\ink\sk-sk\Windows 2000.iso .com	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\clicktorun\Internet Explorer 7 FULL BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ý!’½`çñc:\program files\common files\microsoft shared\ink\el-gr\WinRAR 4.01 Cracked BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\ Üñc:\program files\common files\microsoft shared\clicktorun\Playboy centerfold HOT.gif .scr	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]Êu¼çñc:\program files\common files\microsoft shared\ink\he-il\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]Êu¼çñc:\program files\common files\microsoft shared\ink\it-it\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\ˆ$ý*c:\program files\common files\microsoft shared\vc\Windows 2000.iso .com	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ý!’½`çñc:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\WinRAR 4.01 Cracked BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\common files\microsoft shared\textconv\Windows XP SP3 REAL VERSION.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\„æñc:\program files\common files\microsoft shared\vgx\Windows XP SP3 REAL VERSION.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ý!’½`çñc:\program files\common files\microsoft shared\ink\et-ee\WinRAR 4.01 Cracked BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\ c:\progrÿc:\program files\common files\microsoft shared\vgx\WinAmp 5.08 FULL.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\-'’½Ðäñc:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\WinRAR 4.01 Cracked BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program fÿc:\program files\common files\microsoft shared\ink\pt-br\WinAmp 5.08 FULL.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]Êu¼çñc:\program files\common files\microsoft shared\ink\zh-cn\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\H&ý*c:\program files\common files\microsoft shared\triedit\en-us\Windows 2000.iso .com	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\common files\microsoft shared\vsto\10.0\DVD Xcopy PRO Illegal Warez.iso .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\dáñc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\de\Windows XP SP3 REAL VERSION.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ý!’½`çñc:\program files\common files\microsoft shared\ink\nb-no\WinRAR 4.01 Cracked BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]Êu¼çñc:\program files\common files\microsoft shared\ink\en-gb\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ý!’½`çñc:\program files\common files\microsoft shared\ink\pt-br\WinRAR 4.01 Cracked BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]ÊuLêñc:\program files\common files\microsoft shared\stationery\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ý!’½`çñc:\program files\common files\microsoft shared\vsto\10.0\WinRAR 4.01 Cracked BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\NORTON Inte c:\program files\common files\microsoft shared\ink\cs-cz\NORTON Internet security 2006.rar .scr	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\-'’½Ðäñc:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\WinRAR 4.01 Cracked BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	\??\c:\program fÿc:\program files\common files\microsoft shared\ink\pl-pl\WinAmp 5.08 FULL.zip .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]Êu¼çñc:\program files\common files\microsoft shared\ink\ro-ro\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ý!’½`çñc:\program files\common files\microsoft shared\ink\uk-ua\WinRAR 4.01 Cracked BETA.exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]Êu¼çñc:\program files\common files\microsoft shared\ink\bg-bg\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ð„ýc:\program files\common files\microsoft shared\ink\de-de\Windows 2000.iso .com	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]Êu,åñc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\es\Hacking and Virus Writing for Dummies.pdf .exe	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
File created	C:\Users\Admin\AppData\Local\Temp\È(ý*c:\program files\common files\microsoft shared\office16\office setup controller\Windows 2000.iso .com	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
392	761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe

C:\Users\Admin\AppData\Local\Temp\761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe
"C:\Users\Admin\AppData\Local\Temp\761d69e82e8817b288eadee87a87c868e5b292b6eb323bbeb1d50e698d807563.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 3460
  2⤵
  - Program crash
  PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 392 -ip 392
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp

Filesize
896KB

MD5
ff5eaaa53ede124c90876da05f7e86ac

SHA1
32d08cd516cc2012bf3de29d114f57f1526dbb85

SHA256
e23ac3370c545e88b58bbe9ecd30fb0e56eceef47ef1a2173afc8dbed2336e86

SHA512
fc95280103ff618a69bcf840da3eb42c98f851f85acd66ec2f86e38069a8c7df4c75b4556ca9de8322f8d8f23cfd3643248214711b61ab988dd63903686557e1

Download Submit
memory/392-0-0x0000000000400000-0x0000000000D20000-memory.dmp

Filesize
9.1MB

Download
memory/392-2-0x0000000000400000-0x0000000000D20000-memory.dmp

Filesize
9.1MB

Download
memory/392-3-0x0000000000400000-0x0000000000D20000-memory.dmp

Filesize
9.1MB

Download
memory/392-1-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/392-446-0x0000000000400000-0x0000000000D20000-memory.dmp

Filesize
9.1MB

Download