a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
Size

7.5MB
MD5

dd1a6b7dcdbd4cc1860b908779c69141
SHA1

8a51b65bc538f4cbcea726e468b9be7d7d768383
SHA256

a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9
SHA512

31c4890df0ccea8fe547f2d193f0aec31a29c2a96c222d0f0e1e86d370167e69b7165f72163d717334f9cc7e9f33d947a019115a74f9b20678ff37352be367c5
SSDEEP

196608:5xz51LZLi3m38NuPyRqhhhIHVE24f4dYAV:5xz519LmNuPyqhU1E24AdD

Score

8^/10

persistence upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Drivers\ETC\HOSTS	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/100-0-0x0000000000400000-0x0000000000D20000-memory.dmp	upx
behavioral2/memory/100-2-0x0000000000400000-0x0000000000D20000-memory.dmp	upx
behavioral2/memory/100-3-0x0000000000400000-0x0000000000D20000-memory.dmp	upx
behavioral2/files/0x0007000000023245-8.dat	upx
behavioral2/memory/100-517-0x0000000000400000-0x0000000000D20000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe"	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dbexe2.dll	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Windows\SysWOW64\LockFile.dat	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Windows\SysWOW64\DbTasker.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Windows\SysWOW64\DbTasker.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Windows\SysWOW64\hal.dll	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Windows\SysWOW64\DBTASK.EXE	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Windows\SysWOW64\dbzip2.dll	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\program files\common files\microsoft shared\ink\el-gr\Pamela Anderson FULL VIDEO.mpg .scr	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\lt-lt\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\de-de\Full warez download sites.html .pif	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\WinAmp 5.08 FULL.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\es\Internet Explorer 7 FULL BETA.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\bg-bg\Full warez download sites.html .pif	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\clicktorun\HalfLife 2 WORKING Steam Activation crack.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\Matrix Reloaded.avi .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\pt-br\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\source engine\Pamela Anderson FULL VIDEO.mpg .scr	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\pl\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Full warez download sites.html .pif	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\Full warez download sites.html .pif	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\de-de\Pamela Anderson FULL VIDEO.mpg .scr	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\el-gr\Internet Explorer 7 FULL BETA.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\WinAmp 5.08 FULL.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\it-it\WinAmp 5.08 FULL.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\de-de\DVD Xcopy PRO Illegal Warez.iso .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\el-gr\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\WinAmp 5.08 FULL.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\es-es\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\da-dk\Pamela Anderson FULL VIDEO.mpg .scr	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\it-it\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\tr-tr\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\sr-latn-rs\Full warez download sites.html .pif	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\it-it\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\vsto\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ja-jp\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\zh-cn\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\triedit\en-us\Internet Explorer 7 FULL BETA.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\en-us\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\Full warez download sites.html .pif	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\pl-pl\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\en-us\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\dotnet\shared\microsoft.netcore.app\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\it\Pamela Anderson FULL VIDEO.mpg .scr	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\sv-se\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\Pamela Anderson FULL VIDEO.mpg .scr	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\office16\office setup controller\Playboy centerfold HOT.gif .scr	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\office16\How to stop NetSky.doc .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\vsto\Pamela Anderson FULL VIDEO.mpg .scr	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\WinTask.zip	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3796	100	WerFault.exe	86

NTFS ADS 64 IoCs

description	ioc	Process
File created	\??\c:\program fc:\program files\common files\microsoft shared\ink\ko-kr\WinAmp 5.08 FULL.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program fc:\program files\common files\microsoft shared\ink\pl-pl\WinAmp 5.08 FULL.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\Hµtc:\program files\common files\microsoft shared\ink\ar-sa\Norton AntiVirus 2006 BETA.rar .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\,].w¼çñc:\program files\common files\microsoft shared\ink\es-es\Hacking and Virus Writing for Dummies.pdf .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\…aÎ.Ðäñc:\program files\common files\microsoft shared\ink\fsdefinitions\insert\WinRAR 4.01 Cracked BETA.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\common files\microsoft shared\vsto\10.0\DVD Xcopy PRO Illegal Warez.iso .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ådÎ.ðéñc:\program files\common files\microsoft shared\clicktorun\WinRAR 4.01 Cracked BETA.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ôãñc:\program files\common files\microsoft shared\ink\sr-latn-rs\Windows XP SP3 REAL VERSION.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ø)c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\es\Windows 2000.iso .com	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\,].w¼çñc:\program files\common files\microsoft shared\ink\ja-jp\Hacking and Virus Writing for Dummies.pdf .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\°)c:\program files\common files\microsoft shared\ink\fr-ca\Windows 2000.iso .com	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program fc:\program files\common files\microsoft shared\ink\nb-no\WinAmp 5.08 FULL.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\vsto\10.0\1033\Matrix Reloaded.avi .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ð)c:\program files\common files\microsoft shared\ink\en-gb\Windows 2000.iso .com	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ugÎ.`çñc:\program files\common files\microsoft shared\ink\zh-tw\WinRAR 4.01 Cracked BETA.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\…aÎ.Ðäñc:\program files\common files\microsoft shared\ink\fsdefinitions\main\WinRAR 4.01 Cracked BETA.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ugÎ.`çñc:\program files\common files\microsoft shared\msinfo\es-es\WinRAR 4.01 Cracked BETA.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\Üñc:\program files\common files\microsoft shared\ink\ar-sa\Kazaa Lite 2005 Edition.rar .pif	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\,].w¼çñc:\program files\common files\microsoft shared\ink\sr-latn-rs\Hacking and Virus Writing for Dummies.pdf .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program fc:\program files\common files\microsoft shared\msinfo\es-es\WinAmp 5.08 FULL.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\þÿÿÿ8Öñc:\program files\common files\microsoft shared\office16\office setup controller\DVD Xcopy PRO Illegal Warez.iso .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\vsto\Full warez download sites.html .pif	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\vsto\Hacking for Dummies.pdf .cpl	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\,].w¼çñc:\program files\common files\microsoft shared\ink\sl-si\Hacking and Virus Writing for Dummies.pdf .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\€¼(c:\program files\common files\microsoft shared\ink\bg-bg\Windows 2000.iso .com	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\Matrix Reloaded.avi .exec:\program files\common files\microsoft shared\ink\bg-bg\Matrix Reloaded.avi .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ugÎ.`çñc:\program files\common files\microsoft shared\ink\cs-cz\WinRAR 4.01 Cracked BETA.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\,].w¼çñc:\program files\common files\microsoft shared\ink\hwrcustomization\Hacking and Virus Writing for Dummies.pdf .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ôãñc:\program files\common files\microsoft shared\msinfo\de-de\Windows XP SP3 REAL VERSION.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\vsto\10.0\Full warez download sites.html .pif	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\Gc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\cs\Visual Studio .NET FULL.zip .cpl	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\clicktorun\Full warez download sites.html .pif	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\˜ )c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\de\Windows 2000.iso .com	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program fc:\program files\common files\microsoft shared\ink\lv-lv\WinAmp 5.08 FULL.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\X)c:\program files\common files\microsoft shared\vsto\10.0\Windows 2000.iso .com	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\,].w,åñc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\de\Hacking and Virus Writing for Dummies.pdf .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\¡âÇb»Jºß{“Iwœ #·t Ñ³tœÜñc:\program files\common files\microsoft shared\clicktorun\Windows XP SECRET DEVELOPER serials.txt .cmd	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\„æñc:\program files\common files\microsoft shared\source engine\Windows XP SP3 REAL VERSION.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\Lc:\program files\common files\microsoft shared\officesoftwareprotectionplatform\Windows XP SP3 REAL VERSION.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\,].w¼çñc:\program files\common files\microsoft shared\ink\fr-ca\Hacking and Virus Writing for Dummies.pdf .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ugÎ.`çñc:\program files\common files\microsoft shared\ink\uk-ua\WinRAR 4.01 Cracked BETA.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ôãñc:\program files\common files\microsoft shared\msinfo\fr-fr\Windows XP SP3 REAL VERSION.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\…aÎ.Ðäñc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\it\WinRAR 4.01 Cracked BETA.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program fÿc:\program files\d0æñc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\pt-br\WinAmp 5.08 FULL.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\„æñc:\program files\common files\microsoft shared\clicktorun\Windows XP SP3 REAL VERSION.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\˜)c:\program files\common files\microsoft shared\ink\zh-cn\Windows 2000.iso .com	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ôãñc:\program files\common files\microsoft shared\office16\office setup controller\Windows XP SP3 REAL VERSION.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\textconv\WinAmp 5.08 FULL.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\program fÿc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\de\WinAmp 5.08 FULL.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\,].w¼çñc:\program files\common files\microsoft shared\ink\de-de\Hacking and Virus Writing for Dummies.pdf .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\)c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\pl\Windows 2000.iso .com	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ec:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SECRET DEVELOPER serials.txt .cmd	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ugÎ.`çñc:\program files\common files\microsoft shared\ink\hu-hu\WinRAR 4.01 Cracked BETA.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .cmdc:\program files\common files\microsoft shared\ink\ar-sa\HalfLife 2 WORKING Steam Activation crack.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\Lc:\program files\common files\microsoft shared\ink\languagemodel\Windows XP SP3 REAL VERSION.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ugÎ.`çñc:\program files\common files\microsoft shared\ink\lv-lv\WinRAR 4.01 Cracked BETA.exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\)c:\program files\common files\microsoft shared\textconv\en-us\Windows 2000.iso .com	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\´$ING c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\cs\NORTON Internet security 2006.rar .scr	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	\??\c:\pc:\program files\common files\microsoft shared\ink\es-mx\WinAmp 5.08 FULL.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\)c:\program files\common files\microsoft shared\ink\pt-br\Windows 2000.iso .com	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\€ßñc:\program files\common files\microsoft shared\textconv\en-us\Hacking for Dummies.pdf .cpl	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\dotnet\shared\microsoft.netcore.app\Windows XP SP3 REAL VERSION.zip .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\X )c:\program files\common files\microsoft shared\ink\lv-lv\Windows 2000.iso .com	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
File created	C:\Users\Admin\AppData\Local\Temp\,].w,åñc:\program files\common files\microsoft shared\ink\fsdefinitions\main\Hacking and Virus Writing for Dummies.pdf .exe	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
100	a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe

C:\Users\Admin\AppData\Local\Temp\a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe
"C:\Users\Admin\AppData\Local\Temp\a8802f0e2c9ad7c0eff26962f27a73298d3ae81e92b3d42de3ab138450f9b5c9.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 2996
  2⤵
  - Program crash
  PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 100 -ip 100
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp

Filesize
2.2MB

MD5
6d6ab79bb47c3f5c114198406461a925

SHA1
b3f8519e0db9dea57bcbb5608d8375fa95330cb8

SHA256
2d743bd868a12b240994311afabc8c01927254f8154e979f4ee75bf3c431942c

SHA512
7eacc39a27566c64eb16400cdfbb4c1069c84115bcfcd8e557d0fe01242c56aace273f58f7d40e7a5deedf00d4fa7d94bb7b4848e207f7edbb9df20e4d805a78

Download Submit
memory/100-0-0x0000000000400000-0x0000000000D20000-memory.dmp

Filesize
9.1MB

Download
memory/100-1-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/100-2-0x0000000000400000-0x0000000000D20000-memory.dmp

Filesize
9.1MB

Download
memory/100-3-0x0000000000400000-0x0000000000D20000-memory.dmp

Filesize
9.1MB

Download
memory/100-517-0x0000000000400000-0x0000000000D20000-memory.dmp

Filesize
9.1MB

Download