Automated Malware Analysis IOC Report for

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.997823941374321
Filename:	SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Filesize:	48111280
MD5:	bf33e9af43b635a47ba59405048173a6
SHA1:	191d856ce5b9a5ce5831653db15e475d301299b1
SHA256:	49f0fca0e58c3f40319fc730b3423c5b536d9308ec65fe243180a2ef22328978
SHA512:	e3d31cc3e785c3ba6a738459397e4564c474967660c053a4f9f90be979ceccb94bd6c1111aa8cc268f89d54cf0c4436e584a8d8c4943e0738d996154c073e091
SSDEEP:	786432:gmOWNaZ2Q+OGjovnEYZ+iClMZSspzLgF5MF+RvyJs0NgBAiaGbJDnNO3c2TG935n:iI2LGkvzZtcspnMMsvwsYoZPDk3RCJ5n
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qw.W5...5...5.......&.......E...5...........8...............4.......4...5...7.......4...Rich5...........................PE..L..

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands
Drops PE files	Persistence and Installation Behavior
Drops certificate files (DER)	E-Banking Fraud
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior
EXE planting / hijacking vulnerabilities found	Privilege Escalation, Compliance	DLL Side-Loading DLL Search Order Hijacking
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
PE file contains sections with non-standard names	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary	Masquerading
Creates files inside the user directory	System Summary	Masquerading
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Enumerates the file system	Spreading, Malware Analysis System Evasion	File and Directory Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary	System Information Discovery
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Writes ini files	System Summary
PE file has a big raw section	System Summary
Creates license or readme file	Compliance, Persistence and Installation Behavior
PE / OLE file has a valid certificate	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\aussdrv.dl_
Category:	dropped
Dump:	aussdrv.dl_.0.dr
ID:	dr_27
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 90522 bytes, 1 file, at 0x2c +A "aussdrv.dll", number 1, 9 datablocks, 0xf03 compression
Entropy:	7.9974478538975005
Encrypted:	true
Ssdeep:	1536:r0EqjNe79ZQw2Vv3jFNJ6v1MwA0cEHuhMDhdGjH27QnZUO/UlIYjI9eoMKgI+qrV:0e79T6ZN4KJWiMV0jWYUlImSevJqrV
Size:	90522
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_glossyphotopaper170gsm.ic_
Category:	dropped
Dump:	cn_ipf770_series_glossyphotopaper170gsm.ic_.0.dr
ID:	dr_29
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 582358 bytes, 1 file, at 0x2c +A "cn_ipf770_series_glossyphotopaper170gsm.icc", number 1, 21 datablocks, 0xf03 compression
Entropy:	7.996960805569354
Encrypted:	true
Ssdeep:	12288:hJ8r5xh2e3+CgJoGMi6aCl15Wdt+gxTnSpodk/g5J2OuPRQXKCPz:hJ4nX3NgJoc6aCLIdtHSpzY5NuyXKCPz
Size:	582358
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_glossyphotopaperhg170.ic_
Category:	dropped
Dump:	cn_ipf770_series_glossyphotopaperhg170.ic_.0.dr
ID:	dr_31
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 581177 bytes, 1 file, at 0x2c +A "cn_ipf770_series_glossyphotopaperhg170.icc", number 1, 21 datablocks, 0xf03 compression
Entropy:	7.997503799643727
Encrypted:	true
Ssdeep:	12288:UEIVc3t5jinKpgR0z6ZJlQOnIo7AxlzCCqj4QxIgy6o93VyS31NX:UEIS3LiKWKz6SOnIo4zDqcQ2P93Vy+1V
Size:	581177
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_glossyphotopaperhg255.ic_
Category:	dropped
Dump:	cn_ipf770_series_glossyphotopaperhg255.ic_.0.dr
ID:	dr_33
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 580011 bytes, 1 file, at 0x2c +A "cn_ipf770_series_glossyphotopaperhg255.icc", number 1, 21 datablocks, 0xf03 compression
Entropy:	7.996313613081114
Encrypted:	true
Ssdeep:	12288:8TCVtGCH8nqAPEMS1/oTL9OmTh6OB6Zo7Ri0GsUtmWTmKaEe1:8+VtGCH8nqAodoTAmtEZoATmZKad1
Size:	580011
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_photopaperplussemi-gloss.ic_
Category:	dropped
Dump:	cn_ipf770_series_photopaperplussemi-gloss.ic_.0.dr
ID:	dr_35
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 587774 bytes, 1 file, at 0x2c +A "cn_ipf770_series_photopaperplussemi-gloss.icc", number 1, 21 datablocks, 0xf03 compression
Entropy:	7.9965522646368505
Encrypted:	true
Ssdeep:	12288:Jq3kDb6VghvhGMbKBhdjCT3sQzYR+WdwB2fIpqlSPVa/OHJPfVdzn:Jq3kDIgdxKL9CT3U8WDfI4sVaG1z
Size:	587774
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_premiumglossypaper2-280.ic_
Category:	dropped
Dump:	cn_ipf770_series_premiumglossypaper2-280.ic_.0.dr
ID:	dr_37
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 584569 bytes, 1 file, at 0x2c +A "cn_ipf770_series_premiumglossypaper2-280.icc", number 1, 21 datablocks, 0xf03 compression
Entropy:	7.996754453306316
Encrypted:	true
Ssdeep:	12288:t31O5jcq8sJDTuRqBLzYqtaihJkRRcqL2eapXzHaHp:l1OdcqPJDyR6WRRRLhapXe
Size:	584569
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_premiumsemiglossypaper2-280.ic_
Category:	dropped
Dump:	cn_ipf770_series_premiumsemiglossypaper2-280.ic_.0.dr
ID:	dr_39
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 584241 bytes, 1 file, at 0x2c +A "cn_ipf770_series_premiumsemiglossypaper2-280.icc", number 1, 21 datablocks, 0xf03 compression
Entropy:	7.996544591651677
Encrypted:	true
Ssdeep:	12288:VL2V+9YEoHZDpx78VsGdYDZ4oEl2rzMA1Vt7yzxo:IV/HhT7EsGdY1E2rzntOzC
Size:	584241
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_satinphotopaper170gsm.ic_
Category:	dropped
Dump:	cn_ipf770_series_satinphotopaper170gsm.ic_.0.dr
ID:	dr_10
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 582113 bytes, 1 file, at 0x2c +A "cn_ipf770_series_satinphotopaper170gsm.icc", number 1, 21 datablocks, 0xf03 compression
Entropy:	7.996615657655328
Encrypted:	true
Ssdeep:	12288:XFViuLlWRZQSrFJ41edrkpoZQwwuokA+DRa5/PkdRBC+C2vVn:Xric+Q4JJdrk6wY5k5/MPBrvB
Size:	582113
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_semi-glossyphotopaperhg170.ic_
Category:	dropped
Dump:	cn_ipf770_series_semi-glossyphotopaperhg170.ic_.0.dr
ID:	dr_11
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 581294 bytes, 1 file, at 0x2c +A "cn_ipf770_series_semi-glossyphotopaperhg170.icc", number 1, 21 datablocks, 0xf03 compression
Entropy:	7.997303082375696
Encrypted:	true
Ssdeep:	12288:F9+5p+/839bDR2Af6xMJBWwa+aY2Ltud8tAW260rmgTkO6XOe9/o:FGy8tbgO6+aY2LXtADVmTBX7w
Size:	581294
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_semi-glossyphotopaperhg255.ic_
Category:	dropped
Dump:	cn_ipf770_series_semi-glossyphotopaperhg255.ic_.0.dr
ID:	dr_12
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 580024 bytes, 1 file, at 0x2c +A "cn_ipf770_series_semi-glossyphotopaperhg255.icc", number 1, 21 datablocks, 0xf03 compression
Entropy:	7.996282575761241
Encrypted:	true
Ssdeep:	12288:0GvRTCVtGCH8nqAPEMS1/oTL9OmTh6OB6Zo7Ri0GsUtmW1XsNX:0CR+VtGCH8nqAodoTAmtEZoATmqst
Size:	580024
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw407.dl_
Category:	dropped
Dump:	cnw407.dl_.0.dr
ID:	dr_13
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 912357 bytes, 1 file, at 0x2c +A "cnw407.dll", number 1, 142 datablocks, 0xf03 compression
Entropy:	7.999431060308052
Encrypted:	true
Ssdeep:	24576:jQfgmYLyyaEp5I4JyiU2kPGpSau1exH7BNB+aQaI:jQ4mYyEwjYO1exJlQD
Size:	912357
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw409.dl_
Category:	dropped
Dump:	cnw409.dl_.0.dr
ID:	dr_14
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 910565 bytes, 1 file, at 0x2c +A "cnw409.dll", number 1, 142 datablocks, 0xf03 compression
Entropy:	7.999440724015825
Encrypted:	true
Ssdeep:	24576:FLef9yecdRV3p7gJ+pn3DMan6+LVAza1P7va7ENfA/xIKAk:liEr3F1zMGVAze7vacOaKAk
Size:	910565
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw40a.dl_
Category:	dropped
Dump:	cnw40a.dl_.0.dr
ID:	dr_15
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 912695 bytes, 1 file, at 0x2c +A "cnw40a.dll", number 1, 142 datablocks, 0xf03 compression
Entropy:	7.999144252366757
Encrypted:	true
Ssdeep:	24576:Lf2mMzhPRwMjGzUqDrE6Rhu5fHY5XpxdgHwmlQ1DeRLwsU:DowIGNDrE6RuYrxdgHB28dwz
Size:	912695
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw40c.dl_
Category:	dropped
Dump:	cnw40c.dl_.0.dr
ID:	dr_16
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 912931 bytes, 1 file, at 0x2c +A "cnw40c.dll", number 1, 142 datablocks, 0xf03 compression
Entropy:	7.999162403474395
Encrypted:	true
Ssdeep:	24576:FXtDvOZMXv9tUsmB56zzH0KlZT6QDD+rsons3jbQk2QvF:fOiXvY/yzH0KlZBPUnojbZ2K
Size:	912931
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw410.dl_
Category:	dropped
Dump:	cnw410.dl_.0.dr
ID:	dr_17
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 911981 bytes, 1 file, at 0x2c +A "cnw410.dll", number 1, 142 datablocks, 0xf03 compression
Entropy:	7.999330301607015
Encrypted:	true
Ssdeep:	24576:UwFbU5ws5CE2z+gjqt+BHKmzrheY8KYvS:VF3Mvwq0BHKZY8lS
Size:	911981
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw411.dl_
Category:	dropped
Dump:	cnw411.dl_.0.dr
ID:	dr_18
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 908647 bytes, 1 file, at 0x2c +A "cnw411.dll", number 1, 141 datablocks, 0xf03 compression
Entropy:	7.999518978942718
Encrypted:	true
Ssdeep:	24576:fHfSLMO/ciY1O2SokADLNeHvREe+xyaj9azIkTzLxiVD+6:fH6M6Y1O2S2UPye+tgMkNWD7
Size:	908647
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw412.dl_
Category:	dropped
Dump:	cnw412.dl_.0.dr
ID:	dr_19
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 908147 bytes, 1 file, at 0x2c +A "cnw412.dll", number 1, 141 datablocks, 0xf03 compression
Entropy:	7.999303291558254
Encrypted:	true
Ssdeep:	24576:FbEY64+NM1evpuPniYLYY0u0NroPQtaWh8Rk3jh9Vwm2/P:FIYeDmiYLYY0u0NhTh8Rch9H2/P
Size:	908147
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw416.dl_
Category:	dropped
Dump:	cnw416.dl_.0.dr
ID:	dr_40
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 912745 bytes, 1 file, at 0x2c +A "cnw416.dll", number 1, 142 datablocks, 0xf03 compression
Entropy:	7.999200392005019
Encrypted:	true
Ssdeep:	12288:6MzjzkI2lmqHsUjerq5rDrq6ZDo60Pk/x7JDcLHvRhoQHinh4Ow2Mg2CGZjGUz5A:6Mzjb2ljvYOroyUvTXglMg25ZzE4eXeq
Size:	912745
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw419.dl_
Category:	dropped
Dump:	cnw419.dl_.0.dr
ID:	dr_41
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 913781 bytes, 1 file, at 0x2c +A "cnw419.dll", number 1, 142 datablocks, 0xf03 compression
Entropy:	7.999178288678424
Encrypted:	true
Ssdeep:	24576:Tx2ynauKWG3I5ilmnDJfNbjK/6y08IksHKnxdex:TsWau3F5i4fJjK/6dbkNS
Size:	913781
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw804.dl_
Category:	dropped
Dump:	cnw804.dl_.0.dr
ID:	dr_42
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 908215 bytes, 1 file, at 0x2c +A "cnw804.dll", number 1, 140 datablocks, 0xf03 compression
Entropy:	7.9993760915266
Encrypted:	true
Ssdeep:	12288:tLj3Pc1HvqPNHYk4BHx4xQPiydkZHhqKW/6I8tKtRJKyiW+WCjUUQgGhlu2Dp0z:xj3Pk7Bzha5r18tRvLCj4I2Dpm
Size:	908215
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15ac.ch_
Category:	dropped
Dump:	cnwa15ac.ch_.0.dr
ID:	dr_43
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 323401 bytes, 1 file, at 0x2c +RA "cnwa15ac.chm", number 1, 11 datablocks, 0xf03 compression
Entropy:	7.999059662233479
Encrypted:	true
Ssdeep:	6144:LUqNtK1P+sRhmxZKN86ucGTeq2LMAyNU8oko2Aul8oPEgVfMbt1o:YEQx+sR4Zs86uc+v2ohoko2xyFgV0bLo
Size:	323401
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15af.ch_
Category:	dropped
Dump:	cnwa15af.ch_.0.dr
ID:	dr_44
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 335995 bytes, 1 file, at 0x2c +RA "cnwa15af.chm", number 1, 11 datablocks, 0xf03 compression
Entropy:	7.998987352916105
Encrypted:	true
Ssdeep:	6144:yyib1hSmpJANVAp7ztxrENVM6RXvqTJddLYaqgE9CrCwBhki:ezRkVAJrwNTlvqTJddLYt4Dh
Size:	335995
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15ag.ch_
Category:	dropped
Dump:	cnwa15ag.ch_.0.dr
ID:	dr_45
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 337315 bytes, 1 file, at 0x2c +RA "cnwa15ag.chm", number 1, 11 datablocks, 0xf03 compression
Entropy:	7.998921237943281
Encrypted:	true
Ssdeep:	6144:CvXGKl0MPibrPLOESIemdcwP57F+IuBOzG+RzcipVRH1KtJXc3xM:9Kl0MaHPjPemdcI4YzG+KkVqJEm
Size:	337315
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15ai.ch_
Category:	dropped
Dump:	cnwa15ai.ch_.0.dr
ID:	dr_46
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 335675 bytes, 1 file, at 0x2c +RA "cnwa15ai.chm", number 1, 11 datablocks, 0xf03 compression
Entropy:	7.998808670662929
Encrypted:	true
Ssdeep:	6144:p/sIHBe925ji0p5tHmSEJVfMv7B3HBj+i07b5OyY7txQ//eLuqbY+owZm0bdiK:VsIHBeMwJnnUd398dGtxi3+owZEK
Size:	335675
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15aj.ch_
Category:	dropped
Dump:	cnwa15aj.ch_.0.dr
ID:	dr_47
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 344943 bytes, 1 file, at 0x2c +RA "cnwa15aj.chm", number 1, 11 datablocks, 0xf03 compression
Entropy:	7.99896393660871
Encrypted:	true
Ssdeep:	6144:L17QCUdmAcH5gvmpGLsGKjTbxt8GtncjImhZELYMlq/lQ1vwysXLDes6MGND:Z73AC5SUGLsGKDnBlq/K1jsXv6MGd
Size:	344943
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15ao.ch_
Category:	dropped
Dump:	cnwa15ao.ch_.0.dr
ID:	dr_48
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 335721 bytes, 1 file, at 0x2c +RA "cnwa15ao.chm", number 1, 11 datablocks, 0xf03 compression
Entropy:	7.99859875630728
Encrypted:	true
Ssdeep:	6144:73HV2OjtBQ1Fb6wmDrHxnSiShRd64pDHonbAme5OGr6a7ZSZUB/X6kGY:bHVDjXcb34bNTSDvDHmE5OGW/ZUMkGY
Size:	335721
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15ap.ch_
Category:	dropped
Dump:	cnwa15ap.ch_.0.dr
ID:	dr_49
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 313797 bytes, 1 file, at 0x2c +RA "cnwa15ap.chm", number 1, 11 datablocks, 0xf03 compression
Entropy:	7.998885990067384
Encrypted:	true
Ssdeep:	6144:PJbFpO5Zl6OFr0pivioZdwxp9rG9urPJgOqvvl30rT:JFalXgxoYxfr0u1lH/
Size:	313797
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15ar.ch_
Category:	dropped
Dump:	cnwa15ar.ch_.0.dr
ID:	dr_60
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 329311 bytes, 1 file, at 0x2c +RA "cnwa15ar.chm", number 1, 11 datablocks, 0xf03 compression
Entropy:	7.9989391626500375
Encrypted:	true
Ssdeep:	6144:cII+8U3BSRowhtf5B1m+RIN/hU7746TLaprr4hAGDh5faaUlN54wTKDXs:+h6Wo+D1mf8777KxmDG698
Size:	329311
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15as.ch_
Category:	dropped
Dump:	cnwa15as.ch_.0.dr
ID:	dr_61
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 330539 bytes, 1 file, at 0x2c +RA "cnwa15as.chm", number 1, 11 datablocks, 0xf03 compression
Entropy:	7.9988007810583515
Encrypted:	true
Ssdeep:	6144:X9Q3sn+HyjuK1pjSbbVr4sX+4oeYtqXol5AeqOY7/9mCWX3XeeVFihxslIq:mhyb1C8VA4vA1lRmCWXbiPslIq
Size:	330539
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15au.ch_
Category:	dropped
Dump:	cnwa15au.ch_.0.dr
ID:	dr_62
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 313797 bytes, 1 file, at 0x2c +RA "cnwa15au.chm", number 1, 11 datablocks, 0xf03 compression
Entropy:	7.998885768087126
Encrypted:	true
Ssdeep:	6144:6JbFpO5Zl6OFr0pivioZdwxp9rG9urPJgOqvvl30rT:yFalXgxoYxfr0u1lH/
Size:	313797
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwfcgco.dl_
Category:	dropped
Dump:	cnwfcgco.dl_.0.dr
ID:	dr_63
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 360997 bytes, 1 file, at 0x2c +A "cnwfcgco.dll", number 1, 31 datablocks, 0xf03 compression
Entropy:	7.99900564918932
Encrypted:	true
Ssdeep:	6144:fU96zmW30Pd6VlJ0rWjxBRkTRrXKEg7jjkOPR0OyYywVAQflQ+C4EuWu/:896zb0Vq7o4xB6drXbLARby7wV/dQb45
Size:	360997
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwfdpkj.dl_
Category:	dropped
Dump:	cnwfdpkj.dl_.0.dr
ID:	dr_64
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 34551 bytes, 1 file, at 0x2c +A "cnwfdpkj.dll", number 1, 3 datablocks, 0xf03 compression
Entropy:	7.99407122039516
Encrypted:	true
Ssdeep:	768:H+8jiZAkWRGwwHBldfYxT/v3q6afRBWF7Ukt:H7irWRGwwpYxbfq64RY1Ug
Size:	34551
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwfdpkk.dl_
Category:	dropped
Dump:	cnwfdpkk.dl_.0.dr
ID:	dr_65
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 34551 bytes, 1 file, at 0x2c +A "cnwfdpkk.dll", number 1, 3 datablocks, 0xf03 compression
Entropy:	7.99407122039516
Encrypted:	true
Ssdeep:	768:O+8jiZAkWRGwwHBldfYxT/v3q6afRBWF7Ukt:O7irWRGwwpYxbfq64RY1Ug
Size:	34551
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwiosif.dl_
Category:	dropped
Dump:	cnwiosif.dl_.0.dr
ID:	dr_67
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 39919 bytes, 1 file, at 0x2c +A "cnwiosif.dll", number 1, 3 datablocks, 0xf03 compression
Entropy:	7.995172655425348
Encrypted:	true
Ssdeep:	768:4tLFBSmldEFKN8H4Zzyjw6fzkbUlCbO/zYadRdsT2oe2peuZ4BIsL:dWdKKTZFYAIyEzVKTVpeuU1L
Size:	39919
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwiwebi.dl_
Category:	dropped
Dump:	cnwiwebi.dl_.0.dr
ID:	dr_68
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 38279 bytes, 1 file, at 0x2c +A "cnwiwebi.dll", number 1, 3 datablocks, 0xf03 compression
Entropy:	7.994871343375653
Encrypted:	true
Ssdeep:	768:5ojnBsJuH/G32/g22eVzj66YHjbl7dB4BFu3Su9BjoHo0ixPCbgs0:+jnWeGmI22uzj6lHl7dss3X9BjiHWPCa
Size:	38279
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwm.dl_
Category:	dropped
Dump:	cnwm.dl_.0.dr
ID:	dr_69
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 640923 bytes, 1 file, at 0x2c +A "cnwm.dll", number 1, 54 datablocks, 0xf03 compression
Entropy:	7.999361611162643
Encrypted:	true
Ssdeep:	12288:iHLz63MoEtfISPyj/LQ1T4FzFR94iaoxO+h/rlYUm3apwCBGDPLwFFz2G:iSMoKGj/LQOM+hN2EwmAasG
Size:	640923
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwmui.dl_
Category:	dropped
Dump:	cnwmui.dl_.0.dr
ID:	dr_80
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 1036321 bytes, 1 file, at 0x2c +A "cnwmui.dll", number 1, 112 datablocks, 0xf03 compression
Entropy:	7.99938918868728
Encrypted:	true
Ssdeep:	24576:tFYxlvCYSEG9N4VBsns0sh3psL5FXga1/nb++EJZT:vYxtCGY6Bsns0UZM5tgD+kZT
Size:	1036321
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwp0rsw.dl_
Category:	dropped
Dump:	cnwp0rsw.dl_.0.dr
ID:	dr_81
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 420171 bytes, 1 file, at 0x2c +A "cnwp0rsw.dll", number 1, 39 datablocks, 0xf03 compression
Entropy:	7.998817623110585
Encrypted:	true
Ssdeep:	6144:794Fm07VB1OfiJk5/mtP+wJT0xhwaZOG6f/yus2ChbO0QRlqrCcyJ5et6wULu1ko:KF97nS1I2q0RZOGqyus2lqqq3q67IyN
Size:	420171
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvprev.ex_
Category:	dropped
Dump:	cnwvprev.ex_.0.dr
ID:	dr_82
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 507273 bytes, 1 file, at 0x2c +A "cnwvprev.exe", number 1, 56 datablocks, 0xf03 compression
Entropy:	7.998583602740771
Encrypted:	true
Ssdeep:	12288:EMykYrFde3AhuZCJDiDBRMqleto2CNG0tEbMVGN2Vc5g4J2p8IxWe:FBquZEDiDTMwlioVU5rgp8Ixj
Size:	507273
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr407.dl_
Category:	dropped
Dump:	cnwvr407.dl_.0.dr
ID:	dr_83
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 224745 bytes, 1 file, at 0x2c +A "cnwvr407.dll", number 1, 72 datablocks, 0xf03 compression
Entropy:	7.994559200820794
Encrypted:	true
Ssdeep:	6144:qgrHbLl/LfWkkmDtcs6i8Sw3QMvryKhT6cie8n:pr7LhzjTYSqT6cF8n
Size:	224745
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr409.dl_
Category:	dropped
Dump:	cnwvr409.dl_.0.dr
ID:	dr_84
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 224413 bytes, 1 file, at 0x2c +A "cnwvr409.dll", number 1, 72 datablocks, 0xf03 compression
Entropy:	7.995643534390587
Encrypted:	true
Ssdeep:	3072:keK6ixVvZQ0aX6vKjpfWcpNIfbtlfC9doJgBLG6nhNbrpUlTYmZJ1dhIA9dQ/dbC:kciA6vKjpx/cM9DBLGCzbUX1d+IedC
Size:	224413
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr40a.dl_
Category:	dropped
Dump:	cnwvr40a.dl_.0.dr
ID:	dr_85
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 224619 bytes, 1 file, at 0x2c +A "cnwvr40a.dll", number 1, 72 datablocks, 0xf03 compression
Entropy:	7.994420023156288
Encrypted:	true
Ssdeep:	6144:vVQLZpOjAw/EvWJ/pljaStJg0z4G08BCm8HKr:dqALcv2BBtJT+8Bmqr
Size:	224619
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr40c.dl_
Category:	dropped
Dump:	cnwvr40c.dl_.0.dr
ID:	dr_86
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 224653 bytes, 1 file, at 0x2c +A "cnwvr40c.dll", number 1, 72 datablocks, 0xf03 compression
Entropy:	7.994897223286202
Encrypted:	true
Ssdeep:	3072:QFQPJTLyKSc1A63tH6vEPN6HuzjiPWkldSXT47WUKuRBdics9NRmJu:QFsQKS8A63tHBPvz/wos7JScs9NUg
Size:	224653
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr410.dl_
Category:	dropped
Dump:	cnwvr410.dl_.0.dr
ID:	dr_87
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 224633 bytes, 1 file, at 0x2c +A "cnwvr410.dll", number 1, 72 datablocks, 0xf03 compression
Entropy:	7.994822061894576
Encrypted:	true
Ssdeep:	6144:olZpE9uP/TVsD+s7DDw1sLls2s7HPAXtx4n8m2ZGGMOhB:oH6kSDzc1sLlsxoMn8mzGnhB
Size:	224633
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr411.dl_
Category:	dropped
Dump:	cnwvr411.dl_.0.dr
ID:	dr_88
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 224469 bytes, 1 file, at 0x2c +A "cnwvr411.dll", number 1, 72 datablocks, 0xf03 compression
Entropy:	7.994764511837537
Encrypted:	true
Ssdeep:	6144:8kgpPQrh2+VwsW+RWB9lnhinUCdTMo8if3mnS:8XpQrhRwsW+QLboJ13mnS
Size:	224469
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr412.dl_
Category:	dropped
Dump:	cnwvr412.dl_.0.dr
ID:	dr_89
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 224749 bytes, 1 file, at 0x2c +A "cnwvr412.dll", number 1, 72 datablocks, 0xf03 compression
Entropy:	7.992980392451281
Encrypted:	true
Ssdeep:	6144:UlxSzw/fcYbGoNmDWy3ho7ZgAYB8r57souJ:mSzefcYbl8P3ho7ZgAYK1QJ
Size:	224749
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr416.dl_
Category:	dropped
Dump:	cnwvr416.dl_.0.dr
ID:	dr_100
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 224701 bytes, 1 file, at 0x2c +A "cnwvr416.dll", number 1, 72 datablocks, 0xf03 compression
Entropy:	7.995094781630282
Encrypted:	true
Ssdeep:	6144:MvrSx4kGJvV3LysQcv2FwNNrRCKm8glwrtagG:MvrZkGZV+sQcOqNNZe7
Size:	224701
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr419.dl_
Category:	dropped
Dump:	cnwvr419.dl_.0.dr
ID:	dr_101
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 224991 bytes, 1 file, at 0x2c +A "cnwvr419.dll", number 1, 72 datablocks, 0xf03 compression
Entropy:	7.994507903631948
Encrypted:	true
Ssdeep:	6144:r+fL1xPiCdgEzCJ2Bn0ULzY91PFRKVhOjjb:+PiZEzC210UPI1dRm8b
Size:	224991
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr804.dl_
Category:	dropped
Dump:	cnwvr804.dl_.0.dr
ID:	dr_102
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 224503 bytes, 1 file, at 0x2c +A "cnwvr804.dll", number 1, 72 datablocks, 0xf03 compression
Entropy:	7.992078485472579
Encrypted:	true
Ssdeep:	6144:WjmCUioiWkFsTFj7plDnFMqt9680l7DATaD3p7j/G/qM:gNvoiOTFjNVKqt9TS2qpXG/j
Size:	224503
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnww77jm.ci_
Category:	dropped
Dump:	cnww77jm.ci_.0.dr
ID:	dr_103
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4171289 bytes, 1 file, at 0x2c +A "cnww77jm.cip", number 1, 150 datablocks, 0xf03 compression
Entropy:	7.99738783351954
Encrypted:	true
Ssdeep:	98304:+4Jt4a4WRuPu08mwkWXYK5tffWTJvaNmVRnvFZGnjFklrM:+4h1JowkWZtfeTJv/5vFEZt
Size:	4171289
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc10dw1.ex_
Category:	dropped
Dump:	cpc10dw1.ex_.0.dr
ID:	dr_120
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 367883 bytes, 1 file, at 0x2c +A "cpc10dw1.exe", number 1, 31 datablocks, 0xf03 compression
Entropy:	7.999053707556759
Encrypted:	true
Ssdeep:	6144:XZ+5GkIsHgxEhtY5wnIFgWTWfxNr/cPz+Jm5PJXTLSrFt2Qr8cE5vaSdONL:Xm9xgMw6zKz+I5PJXnORr05p8NL
Size:	367883
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc10ew1.dl_
Category:	dropped
Dump:	cpc10ew1.dl_.0.dr
ID:	dr_121
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 342443 bytes, 1 file, at 0x2c +A "cpc10ew1.dll", number 1, 38 datablocks, 0xf03 compression
Entropy:	7.999097165786661
Encrypted:	true
Ssdeep:	6144:Z6NvODZiSbGEQvAMPs9NGaByTYlC8o7ILWxDRuhltSfgmntHKketHRXHHh:0NojsAMPs2lTYKxDatKHKf3h
Size:	342443
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc10qw1.ex_
Category:	dropped
Dump:	cpc10qw1.ex_.0.dr
ID:	dr_122
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 404403 bytes, 1 file, at 0x2c +A "cpc10qw1.exe", number 1, 45 datablocks, 0xf03 compression
Entropy:	7.999069698774446
Encrypted:	true
Ssdeep:	6144:AgR2/E7XbhOCjwp+6RqgBtn93i4lfmAWuYrXFqWidsZVSEBE9sWr/kyDwCC6fqp:Pi+jergyt93iZ/VroFmVNQs6MyDA6fqp
Size:	404403
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc10sw1.dl_
Category:	dropped
Dump:	cpc10sw1.dl_.0.dr
ID:	dr_123
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 124957 bytes, 1 file, at 0x2c +A "cpc10sw1.dll", number 1, 9 datablocks, 0xf03 compression
Entropy:	7.991805857970294
Encrypted:	true
Ssdeep:	3072:hmzduic+g746qVZ1zNpITJp9l0W+5Rsj44B:hyUic2vreTJjlLsN4B
Size:	124957
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc10vw1.ex_
Category:	dropped
Dump:	cpc10vw1.ex_.0.dr
ID:	dr_124
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 319873 bytes, 1 file, at 0x2c +A "cpc10vw1.exe", number 1, 28 datablocks, 0xf03 compression
Entropy:	7.999108462059133
Encrypted:	true
Ssdeep:	6144:BAMiNeVuvMFOUGtoZdAMaewZMXCqe8ognL0xCq2iemxI6eqV4V/h82+Fy71l6hV:BAM2euMFZnSewz+oggC9idxIOV4hYFCc
Size:	319873
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1csw1.ch_
Category:	dropped
Dump:	cpc1csw1.ch_.0.dr
ID:	dr_125
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 21031 bytes, 1 file, at 0x2c +A "cpc1csw1.chm", number 1, 1 datablock, 0xf03 compression
Entropy:	7.991134530547848
Encrypted:	true
Ssdeep:	384:Rj2fp1QwKuSjd3dsWZAtGNeA/9tA5c7JKZN/He0YMf+aUZ58ETZOKD2W:RafHQcSjd3iWuc304JSJHeMf+a055OKh
Size:	21031
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1csw1.dl_
Category:	dropped
Dump:	cpc1csw1.dl_.0.dr
ID:	dr_126
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 59227 bytes, 1 file, at 0x2c +A "cpc1csw1.dll", number 1, 18 datablocks, 0xf03 compression
Entropy:	7.993349640289956
Encrypted:	true
Ssdeep:	1536:A7BDF4TrPJpFRwV6ZQTzYmz+I5sxHtz1BG8W:AYrhp0V6ZwzYk3WvzTQ
Size:	59227
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1dew1.dl_
Category:	dropped
Dump:	cpc1dew1.dl_.0.dr
ID:	dr_128
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 60795 bytes, 1 file, at 0x2c +A "cpc1dew1.dll", number 1, 19 datablocks, 0xf03 compression
Entropy:	7.99375421523368
Encrypted:	true
Ssdeep:	1536:y0p6iUpnz0SyeuJsbSVo/lSMVh8494+4t3:y0p61pYu6s+VSh8w45
Size:	60795
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1esw1.dl_
Category:	dropped
Dump:	cpc1esw1.dl_.0.dr
ID:	dr_140
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 60583 bytes, 1 file, at 0x2c +A "cpc1esw1.dll", number 1, 19 datablocks, 0xf03 compression
Entropy:	7.994041442672645
Encrypted:	true
Ssdeep:	1536:aFCmFiBWgnZQ+9mmmzUvJFfdlnp4bf/BTuJNgWQ:6iBWB+9n86Ffdl2IJiF
Size:	60583
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1frw1.dl_
Category:	dropped
Dump:	cpc1frw1.dl_.0.dr
ID:	dr_142
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 60507 bytes, 1 file, at 0x2c +A "cpc1frw1.dll", number 1, 19 datablocks, 0xf03 compression
Entropy:	7.993253265145762
Encrypted:	true
Ssdeep:	1536:vHrPH5B3jZxwuve/XIp+AdxqvkaOItxvIhKoo48b5gxb:vzZ1e/mJxqTLoo3up
Size:	60507
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1itw1.dl_
Category:	dropped
Dump:	cpc1itw1.dl_.0.dr
ID:	dr_144
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 60319 bytes, 1 file, at 0x2c +A "cpc1itw1.dll", number 1, 19 datablocks, 0xf03 compression
Entropy:	7.994193186709418
Encrypted:	true
Ssdeep:	1536:A0qmu4gLhvH7xwY259NNufB11x5AMbIMVTPRWsGJJkBmu:AmmLBH7I59TufB9Bx/OkBJ
Size:	60319
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1jpw1.ch_
Category:	dropped
Dump:	cpc1jpw1.ch_.0.dr
ID:	dr_145
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 25613 bytes, 1 file, at 0x2c +A "cpc1jpw1.chm", number 1, 2 datablocks, 0xf03 compression
Entropy:	7.990835689229193
Encrypted:	true
Ssdeep:	384:V9HhRdBpkzFOAPZiNG/KII6MJMEGPFG8GW+nIcI7ylW7Nz7suYd8AdHR6EaMwlbW:PJBp+U+Q8YnW02z7lYdDxMhMwlb3dK7
Size:	25613
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1jpw1.dl_
Category:	dropped
Dump:	cpc1jpw1.dl_.0.dr
ID:	dr_146
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 59305 bytes, 1 file, at 0x2c +A "cpc1jpw1.dll", number 1, 18 datablocks, 0xf03 compression
Entropy:	7.993398914394858
Encrypted:	true
Ssdeep:	1536:eJp/YqY5PMj7gxKm9hChbtphZ/9eptfaxnow6nk:ekF5mEtsh2ptyv
Size:	59305
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1krw1.dl_
Category:	dropped
Dump:	cpc1krw1.dl_.0.dr
ID:	dr_148
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 59733 bytes, 1 file, at 0x2c +A "cpc1krw1.dll", number 1, 18 datablocks, 0xf03 compression
Entropy:	7.992623847323333
Encrypted:	true
Ssdeep:	1536:zj2ayPqZRbq7XXxF6S+9g2W+6PlVyvycypxygFcu:zHzRbsXL6Scg2WtPjcUxhFN
Size:	59733
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1ruw1.ch_
Category:	dropped
Dump:	cpc1ruw1.ch_.0.dr
ID:	dr_149
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 20955 bytes, 1 file, at 0x2c +A "cpc1ruw1.chm", number 1, 1 datablock, 0xf03 compression
Entropy:	7.990002880793497
Encrypted:	true
Ssdeep:	384:in2ncznbZF0vWNhk/Z7fRIpyTHIA7R0IpMs58H6Ch7tO2ZjVCnPOXfAINQqt35:ingsF0vWLgvH40MYgO2ZjCP6oY95
Size:	20955
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1ruw1.dl_
Category:	dropped
Dump:	cpc1ruw1.dl_.0.dr
ID:	dr_160
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 60847 bytes, 1 file, at 0x2c +A "cpc1ruw1.dll", number 1, 19 datablocks, 0xf03 compression
Entropy:	7.993582826937295
Encrypted:	true
Ssdeep:	1536:TRGgcEPZDCaw4/5rDUlWSd04GjRUj4pPBsC18TFcN:4gc6hzxDOdkR3pKC0FcN
Size:	60847
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1usw1.dl_
Category:	dropped
Dump:	cpc1usw1.dl_.0.dr
ID:	dr_162
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 59933 bytes, 1 file, at 0x2c +A "cpc1usw1.dll", number 1, 19 datablocks, 0xf03 compression
Entropy:	7.994361327898447
Encrypted:	true
Ssdeep:	1536:tEiOncmr5WXfHyKDtTgIBiXdPlM2VZmzKOci+L1:tEnVWvHllBiX/LWzKObC
Size:	59933
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data1.cab
Category:	dropped
Dump:	Data1.cab.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, many, 744649 bytes, 21 files, at 0x2c +A "CN\setuprsc.dll" +A "CN\uinstrsc.dll", number 1, 98 datablocks, 0x1503 compression
Entropy:	7.9989879161525925
Encrypted:	true
Ssdeep:	12288:H0ouUPH6+VobG3dFqR35sC5p4yIyWDmn0VkWgxo8L1H2EVLKkwO5:HsQVvD4tpJWPoouWOLK72
Size:	744649
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data2.cab
Category:	dropped
Dump:	Data2.cab.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, many, 7140158 bytes, 95 files, at 0x2c +A "Canon CIW Extension.dll" +A "cnpdsdk.dll", number 1, 1409 datablocks, 0x1503 compression
Entropy:	7.99841266270066
Encrypted:	true
Ssdeep:	196608:qKmm5OsZNniJIj8iLhhD0Ye0AH5LK/wHiBH6I0p:q6OsjUIQiLXgYe0AH5W/wC4b
Size:	7140158
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\DDI\CAB1.CAB
Category:	dropped
Dump:	CAB1.CAB.0.dr
ID:	dr_76
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, many, 599735 bytes, 5 files, at 0x2c +A "CDDI_SDK.dll" +A "CDDITCPIP.ext", number 1, 47 datablocks, 0x1 compression
Entropy:	7.9939855533908215
Encrypted:	true
Ssdeep:	12288:rS/nz8W347b7Ubfkyc28uInnjnVY5aaiSKoWjgLT43lnF1nAod:rS/z8n7bgLkycjuInjnSoDHNPnd
Size:	599735
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes many files with high entropy	Spam, unwanted Advertisements and Ransom Demands

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\CHECKSUM
Category:	dropped
Dump:	CHECKSUM.0.dr
ID:	dr_21
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.284127309515397
Encrypted:	false
Ssdeep:	384:Q17rG0HGNJP5OKJhQMTS67c6h6KY66nZD:MQiYLCnZD
Size:	12820
Whitelisted:	false
Reputation:	low

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\6WW77JM.INF
Category:	dropped
Dump:	6WW77JM.INF.0.dr
ID:	dr_25
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Windows setup INFormation
Entropy:	5.473895041716401
Encrypted:	false
Ssdeep:	192:4fSb5AG4csGvsTc9UOfFcP+/6jhuQPUKs97Kdpk7Llp:AS90cHsTc9zfFcP+/6ljPUKIWeLlp
Size:	6884
Whitelisted:	false
Reputation:	low

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\6WW77JM.cat
Category:	dropped
Dump:	6WW77JM.cat.0.dr
ID:	dr_23
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	data
Entropy:	5.517491808595263
Encrypted:	false
Ssdeep:	384:NJkucBig1mR3ICCuRC5jB9iBW2hgsneeqsBZMCEUrHUzbsfxT19nKsQhobN89Jrk:EvVAW/k8d4uctEKXT3SzK
Size:	43380
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Chinese_Simplified.txt
Category:	dropped
Dump:	License_Chinese_Simplified.txt.0.dr
ID:	dr_163
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	ISO-8859 text, with very long lines (556), with CRLF line terminators
Entropy:	6.542476018506035
Encrypted:	false
Ssdeep:	96:4C05TMCfK3bogUDhs0yuQna1fF8yCXy0Oxc5a2MgT8mqRVO4DcwX:gTMgK30gAe0yuQcfCXFNqP5vX
Size:	3859
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_English.txt
Category:	dropped
Dump:	License_English.txt.0.dr
ID:	dr_164
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	ASCII text, with very long lines (993), with CRLF line terminators
Entropy:	5.142001411707478
Encrypted:	false
Ssdeep:	192:zhNzPMpOBwZLZ3fUbz9Sff/WdfbC9SDCyNqP0qHMcm:tdk+WOM/WdCyIMcm
Size:	6484
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_French.txt
Category:	dropped
Dump:	License_French.txt.0.dr
ID:	dr_165
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Non-ISO extended-ASCII text, with very long lines (1165), with CRLF line terminators
Entropy:	5.093263497659427
Encrypted:	false
Ssdeep:	192:qwHYRl67SMYN+/ngTtmWh8DB+WaYNqPix3o:xHFlnGtmN+WaYNx3o
Size:	7633
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_German.txt
Category:	dropped
Dump:	License_German.txt.0.dr
ID:	dr_166
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	ISO-8859 text, with very long lines (1154), with CRLF line terminators
Entropy:	5.190750765780741
Encrypted:	false
Ssdeep:	96:7bY7gWJSRdQllh3dC3dn4QX+lj3SNLOUGlsFvl3gwPb4rjDUqsnwFGMgT8mqRVew:25J+e23zX+lj3eLO5lsFvlwQaGNqPII
Size:	7359
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Italian.txt
Category:	dropped
Dump:	License_Italian.txt.0.dr
ID:	dr_167
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Non-ISO extended-ASCII text, with very long lines (1028), with CRLF line terminators
Entropy:	5.0602238198316964
Encrypted:	false
Ssdeep:	96:abzvkcOELZ4pOtGmILkOucjUSzEng8eqxQPJeqReT83cQCGpuFvycJjMgT8mqRVw:aMlE8OdZOuTSWe3PJeKsWuFVFNqPSKVS
Size:	7140
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Japanese.txt
Category:	dropped
Dump:	License_Japanese.txt.0.dr
ID:	dr_168
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Non-ISO extended-ASCII text, with very long lines (518), with CRLF, NEL line terminators
Entropy:	6.081092070443856
Encrypted:	false
Ssdeep:	96:PR90kLMLRucvzXof0YSFrFbuql6CNJ+EqLMjMwbqfyolLjMgTMmMRVzC/:k1LRuIXoIRF3l6iJ+EqLMjZqLVMPzC/
Size:	4920
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Korean.txt
Category:	dropped
Dump:	License_Korean.txt.0.dr
ID:	dr_169
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	ISO-8859 text, with very long lines (530), with CRLF line terminators
Entropy:	5.924335864080618
Encrypted:	false
Ssdeep:	96:5W8eAXGYlIyOLaL5EJstTHQg+4Ed92MUfuXJrOeqlaPCj8MMgT8mqRVAsDK2pA:3jKJat/7hg5FuvNqPTpA
Size:	5469
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Portuguese.txt
Category:	dropped
Dump:	License_Portuguese.txt.0.dr
ID:	dr_180
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	ISO-8859 text, with very long lines (996), with CRLF line terminators
Entropy:	5.17818728858314
Encrypted:	false
Ssdeep:	192:76MCx1dO9Pz/ZKusjDEbFMUGem6AIyVsPiluzsS:eMc1duPz/9bqUbm1Iy7S
Size:	6709
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Russian.txt
Category:	dropped
Dump:	License_Russian.txt.0.dr
ID:	dr_181
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	ISO-8859 text, with very long lines (1182), with CRLF line terminators
Entropy:	5.687989292227232
Encrypted:	false
Ssdeep:	192:UrpQ42CnyAZmuJxnkbkM+IebBk1WYhvV5DjCfzCfVsP9s5lbe:b6hMlAILfi
Size:	7798
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Spanish.txt
Category:	dropped
Dump:	License_Spanish.txt.0.dr
ID:	dr_182
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	ISO-8859 text, with very long lines (1087), with CRLF line terminators
Entropy:	5.091026381663389
Encrypted:	false
Ssdeep:	192:PnrkGE/IlvyagS3MRpxVBFO9QINqPNjL1:PHvyagmMRvV7wy
Size:	7037
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Chinese_Simplified.txt
Category:	dropped
Dump:	ReadMe_Chinese_Simplified.txt.0.dr
ID:	dr_183
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	6.109634698075743
Encrypted:	false
Ssdeep:	192:FnF946eOwUAeYW3qvNj3UQ73yZKiuofuecNW9ERefKR1Y:FI6eOjYW0rUdJyDY
Size:	10751
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_English.txt
Category:	dropped
Dump:	ReadMe_English.txt.0.dr
ID:	dr_184
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.608305666838869
Encrypted:	false
Ssdeep:	384:eOzItZG6MXxVVE8OBepsefLPeONyoBZLyUW:kZRTzBepsefLJ3m
Size:	12304
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_French.txt
Category:	dropped
Dump:	ReadMe_French.txt.0.dr
ID:	dr_185
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.65693356679848
Encrypted:	false
Ssdeep:	384:nOn1bkVX89bPg54UM5b0BHfEa/E3ar0ED/ttAUMpsHJZMs1s9K80H:O1bkVmb4Gb0xl/wF68ns
Size:	15159
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_German.txt
Category:	dropped
Dump:	ReadMe_German.txt.0.dr
ID:	dr_186
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.7616870078926405
Encrypted:	false
Ssdeep:	192:fkvECXth224mz/pJfg5okoeYunTsLcBdK2FJ5AI6vQgXGD0JU8Wm282uQwOfplgf:fkv5L/bUoZL+e2QJTp+TGj
Size:	14526
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Italian.txt
Category:	dropped
Dump:	ReadMe_Italian.txt.0.dr
ID:	dr_187
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.519139394271867
Encrypted:	false
Ssdeep:	192:Ip1wwhgnzAcGNr2L4P2mQZgN67xx6u7PnlDU/KwH1NGQdtRcectJAg:IXynH8hFQZgWPPloS0GHH
Size:	14691
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Japanese.txt
Category:	dropped
Dump:	ReadMe_Japanese.txt.0.dr
ID:	dr_188
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	5.29962881628648
Encrypted:	false
Ssdeep:	192:peKUtFrJR/mZyzP05iEWl71jnmhas5L+O2ZqLVa8EAL2kEMPF7YQATnBBSGQMQrY:pEx02lak8kZALqUY
Size:	15926
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Korean.txt
Category:	dropped
Dump:	ReadMe_Korean.txt.0.dr
ID:	dr_189
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	5.49484033433693
Encrypted:	false
Ssdeep:	384:4nTvXnD6gml/PiVcrBZ026SdyQSvuk7O2c:2nG3likB5z4uk7Of
Size:	14655
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Portuguese.txt
Category:	dropped
Dump:	ReadMe_Portuguese.txt.0.dr
ID:	dr_211
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.672775767949875
Encrypted:	false
Ssdeep:	384:1hYqBXGqMJdG9utHy6Rt9IuS8iDvlDu5tQZX92mQYg2wvx89OD9ye38qKkEMK5qO:1hoDJdG9utHy6n9IuS/blDu5tQZX9DwG
Size:	13605
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Russian.txt
Category:	dropped
Dump:	ReadMe_Russian.txt.0.dr
ID:	dr_213
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.335747326152893
Encrypted:	false
Ssdeep:	384:iqFufRFTbJkMsW/VEr0BuXmWZeqgVySCPewSOXYBgjT1DhDwno4eN8bzzV0yR4:TufRFTwW/VIXmWZZgV54ezOXYQT1lDs6
Size:	22690
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Spanish.txt
Category:	dropped
Dump:	ReadMe_Spanish.txt.0.dr
ID:	dr_214
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.587362213224268
Encrypted:	false
Ssdeep:	384:SDND2KKWFZQ54FBAZetU74BJURlrcabACtBkZeJa1iC6:wgZAjCtBosac
Size:	14603
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwilm64.dl_
Category:	dropped
Dump:	cnwilm64.dl_.0.dr
ID:	dr_66
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 6835 bytes, 1 file, at 0x2c +A "cnwilm64.dll", number 1, 1 datablock, 0xf03 compression
Entropy:	7.969164321837386
Encrypted:	false
Ssdeep:	96:bZZxn1/0Upa3/Nf+ooQ9sppvFMcgPxVMROVmb0WeK9rX/00U0O9OoMZLIrxKIAzE:DT0d3YooispNF3eYykrFwoE8YHwRdxpm
Size:	6835
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnww77jm.up_
Category:	dropped
Dump:	cnww77jm.up_.0.dr
ID:	dr_104
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 11721 bytes, 1 file, at 0x2c +A "cnww77jm.upd", number 1, 2 datablocks, 0xf03 compression
Entropy:	7.97797130872485
Encrypted:	false
Ssdeep:	192:deYUK4xroCrC79Az1k7do+XXYEflfTC166lIUkta2J6oulMJ6MHKSbtAN:dhpunreAJkWaXBfVTC16YetaBoul1ac
Size:	11721
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnww77jm.xp_
Category:	dropped
Dump:	cnww77jm.xp_.0.dr
ID:	dr_105
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 2177 bytes, 1 file, at 0x2c +A "cnww77jm.xpd", number 1, 1 datablock, 0xf03 compression
Entropy:	7.8576511698680065
Encrypted:	false
Ssdeep:	48:a0AkirwluAwlzNU0zD6ZR8GZYexEgCxWtwOUal:LkrwsNjRmEGZY9RAqOZl
Size:	2177
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnww77km.up_
Category:	dropped
Dump:	cnww77km.up_.0.dr
ID:	dr_106
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 11721 bytes, 1 file, at 0x2c +A "cnww77km.upd", number 1, 2 datablocks, 0xf03 compression
Entropy:	7.977997787273408
Encrypted:	false
Ssdeep:	192:yeYUK4xroCrC79Az1k7do+XXYEflfTC166lIUkta2J6oulMJ6MHKSbtAN:yhpunreAJkWaXBfVTC16YetaBoul1ac
Size:	11721
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnww77km.xp_
Category:	dropped
Dump:	cnww77km.xp_.0.dr
ID:	dr_107
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 2177 bytes, 1 file, at 0x2c +A "cnww77km.xpd", number 1, 1 datablock, 0xf03 compression
Entropy:	7.881117589987384
Encrypted:	false
Ssdeep:	48:pV4mrdvIUxJt8RJNungmnjw0D8IPqgTBy/i09cPZoRjr:pV4mSyj8R7uguJD8lgTYr2ZO
Size:	2177
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnxp0log.dl_
Category:	dropped
Dump:	cnxp0log.dl_.0.dr
ID:	dr_108
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 801 bytes, 1 file, at 0x2c +A "cnxp0log.dll", number 1, 1 datablock, 0xf03 compression
Entropy:	7.4949502381644075
Encrypted:	false
Ssdeep:	24:wvuCqv5xQecaBo56BZBykF0YQV+b2GNm6p4C:+unAD2s63c3eJPpj
Size:	801
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnzsrgbc.ic_
Category:	dropped
Dump:	cnzsrgbc.ic_.0.dr
ID:	dr_109
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4521 bytes, 1 file, at 0x2c +A "cnzsrgbc.icc", number 1, 1 datablock, 0xf03 compression
Entropy:	7.940636569659662
Encrypted:	false
Ssdeep:	96:KX78ss3y9jpgH47zUSh/2cSk76T6OXbDneTwIe6C8xFVIX/x:KL8ss3EC4/pp2cr/OrDn2U8HVYx
Size:	4521
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1dew1.ch_
Category:	dropped
Dump:	cpc1dew1.ch_.0.dr
ID:	dr_127
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 21185 bytes, 1 file, at 0x2c +A "cpc1dew1.chm", number 1, 1 datablock, 0xf03 compression
Entropy:	7.989133098150109
Encrypted:	false
Ssdeep:	384:6ESjV8RE5TNqPlQENa85+EHJp8XZ87zAGRTuaTqLhz2lJ2LqPCykUK8L7Fx:6zE1SENa8AEHJpy6bQaTqLN2luOVkUtz
Size:	21185
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1esw1.ch_
Category:	dropped
Dump:	cpc1esw1.ch_.0.dr
ID:	dr_129
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 20921 bytes, 1 file, at 0x2c +A "cpc1esw1.chm", number 1, 1 datablock, 0xf03 compression
Entropy:	7.98801521425368
Encrypted:	false
Ssdeep:	384:ff+4AkYfqFSUbFULW77eM3+v9JRO8OrMpQazIUXq3AJVxc3Uw7yCZVEs5blB:HIjqZ2S7Juv9JU9Mp78nA7xc3KCEs5xB
Size:	20921
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1frw1.ch_
Category:	dropped
Dump:	cpc1frw1.ch_.0.dr
ID:	dr_141
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 20717 bytes, 1 file, at 0x2c +A "cpc1frw1.chm", number 1, 1 datablock, 0xf03 compression
Entropy:	7.989550267418251
Encrypted:	false
Ssdeep:	384:owPWWBHcDNwrlJ5QsH1KYYZGzB3bGjcqCiSxZ2ik66ogfPTWHJ39ngxhpriAu8xA:fJWwDPVKYYobGGdl0PTWHLgxjEkbAusb
Size:	20717
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1itw1.ch_
Category:	dropped
Dump:	cpc1itw1.ch_.0.dr
ID:	dr_143
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 20741 bytes, 1 file, at 0x2c +A "cpc1itw1.chm", number 1, 1 datablock, 0xf03 compression
Entropy:	7.989023096467219
Encrypted:	false
Ssdeep:	384:OglV8jftXf22V66fHF5Q+iPPq43+WeJsu2fx0yHBCxDI24z:Oglkfj7KpP8auyx0yHk02Y
Size:	20741
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1krw1.ch_
Category:	dropped
Dump:	cpc1krw1.ch_.0.dr
ID:	dr_147
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 22229 bytes, 1 file, at 0x2c +A "cpc1krw1.chm", number 1, 1 datablock, 0xf03 compression
Entropy:	7.989898491364522
Encrypted:	false
Ssdeep:	384:/dr4v6TvUelqS9GlZtQb+g9jLN1scbi+0fBn88vnEVwZ5H4XheFqDF7XJaXMa2a5:lr4wUeAlZnghXB90fB88vEVU5H4xeFmq
Size:	22229
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1usw1.ch_
Category:	dropped
Dump:	cpc1usw1.ch_.0.dr
ID:	dr_161
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 20721 bytes, 1 file, at 0x2c +A "cpc1usw1.chm", number 1, 1 datablock, 0xf03 compression
Entropy:	7.988711179786876
Encrypted:	false
Ssdeep:	384:E/LeZc2MqHgOHXqXmzTr5sPhWpS7xxWTCI7w7:kLdwHgOHa2T6wpS7xxWTCI7w7
Size:	20721
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\CHECKSUM
Category:	dropped
Dump:	CHECKSUM1.0.dr
ID:	dr_215
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.222986584446144
Encrypted:	false
Ssdeep:	48:yH2qf2gybykkzplp7vhywieneleGewBe9ecGfexePaes:yH2qftyfCVvek
Size:	2310
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\UninstFiles.ini
Category:	dropped
Dump:	UninstFiles.ini.0.dr
ID:	dr_221
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.102652514350941
Encrypted:	false
Ssdeep:	192:1ydqXctKLgRuvkF/bPARqLsN2XdrnIZiDE1Oflxx2vENiLAJ7Zx2botiHUJXc0b+:QdAl
Size:	6280
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Writes ini files	System Summary	File and Directory Discovery

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\cnwiicef.exe
Category:	dropped
Dump:	cnwiicef.exe.0.dr
ID:	dr_216
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.554692814527826
Encrypted:	false
Ssdeep:	3072:KvZMlc+AXqm5np9Glwu00ESbKq8IzOw0N3me1hx:KvZ4I/R4F00EaKq8Iziwe9
Size:	182864
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
EXE planting / hijacking vulnerabilities found	Privilege Escalation, Compliance	DLL Search Order Hijacking
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\cnwiidci.exe
Category:	dropped
Dump:	cnwiidci.exe.0.dr
ID:	dr_217
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.549427478274386
Encrypted:	false
Ssdeep:	3072:Fc+cJApH4hFbvGTJCCrtqSibf/WrQw8LaHkCvwpbpF+bmF:Fc+cJqY/8B3trQFmHkCSr9F
Size:	178208
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
EXE planting / hijacking vulnerabilities found	Privilege Escalation, Compliance	DLL Search Order Hijacking
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\getinfo.ini
Category:	dropped
Dump:	getinfo.ini.0.dr
ID:	dr_218
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Generic INItialization configuration [OldVersionUtility]
Entropy:	5.2209428250018615
Encrypted:	false
Ssdeep:	96:2RJh7mTFxHwGxFyFahrobPHf9q8/Fs4SK7I6oSB:2jETFxpxFuah8bff9q864P77N
Size:	4449
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\instpack.dll
Category:	dropped
Dump:	instpack.dll.0.dr
ID:	dr_219
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.420200468736576
Encrypted:	false
Ssdeep:	6144:V4pRJjepNSdSQGqkV+o1l2GsnpnrbEbHK1Zuj/MP:V4BAiSX1apnrbNZujE
Size:	299008
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\reg
Category:	dropped
Dump:	reg.0.dr
ID:	dr_220
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.67130744511877
Encrypted:	false
Ssdeep:	3:wgLxqwL9hN0tu+gLxqwL9hNE1eov:PLxTvN0mLxTvNE3v
Size:	103
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\MUI.dll
Category:	dropped
Dump:	MUI.dll.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	2.7284585698794146
Encrypted:	false
Ssdeep:	48:aR8Org1WYGw7ax/wrOzNL3qnOclEO5JtNCSC:O5Sax/YQYdhCt
Size:	4096
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Chinese_Simplified.txt
Category:	dropped
Dump:	Readme_Chinese_Simplified.txt.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	6.126918006238522
Encrypted:	false
Ssdeep:	96:hQIqT5KD2ZDtDWKZW4N4ru+Ka7rcybfDwBB28Hs+++Rxokthqm:hoQ4N417wvDLMDkr
Size:	5323
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_English.txt
Category:	dropped
Dump:	Readme_English.txt.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.695611653851606
Encrypted:	false
Ssdeep:	96:uHPsyeLhkDukDJkDQB6PxP4I8a1KA77Dw6TT8DNImJlgMjDvbwFk7mcwgcYXD:uvsnVhENB6P5a7ADZ38DNI27voUEgh
Size:	6172
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_French.txt
Category:	dropped
Dump:	Readme_French.txt.0.dr
ID:	dr_5
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.768494971359397
Encrypted:	false
Ssdeep:	96:ucfe4DLUZDVUZD3UZDEshaW2CsVjcckMOjuaHxV/FKPMYGJOI8rrwBugiRKjE6pK:urmCmccJXEntzOI8r0rEGl2riLIBAG
Size:	7137
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_German.txt
Category:	dropped
Dump:	Readme_German.txt.0.dr
ID:	dr_6
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.834158793516527
Encrypted:	false
Ssdeep:	192:uJD3nW1wVGGHrF04RYE3BiIGYyVxAh3ei0+g7A2qyWR:uJieVJdGVNing82qR
Size:	7462
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Italian.txt
Category:	dropped
Dump:	Readme_Italian.txt.0.dr
ID:	dr_7
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.623669950462014
Encrypted:	false
Ssdeep:	192:97ipVh+++0iy1/BUCI3XQavUa0f9DGDCIUbW:97We++1yExXQar0f9DXW
Size:	7115
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Japanese.txt
Category:	dropped
Dump:	Readme_Japanese.txt.0.dr
ID:	dr_8
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	5.449517154352485
Encrypted:	false
Ssdeep:	96:ug+H8AXFniNPb+D3gxD3bRDmD3bF1bvCEWgeOGvZrXetfno7EvIhJHR5fTwBnCBH:uyAkwMOwjWtg8f2Gfn9tgfLd
Size:	7365
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Korean.txt
Category:	dropped
Dump:	Readme_Korean.txt.0.dr
ID:	dr_9
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	5.622700198356783
Encrypted:	false
Ssdeep:	96:tFpyVujWDmeDQeD2H6An60sTXj6RFr5ZgaAjbBFd4NwBAV7NqmA/w58Ci40ZtTOp:tzGuFa/yHWacBPy74w8CUW
Size:	7120
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Portuguese.txt
Category:	dropped
Dump:	Readme_Portuguese.txt.0.dr
ID:	dr_20
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.7826975307977895
Encrypted:	false
Ssdeep:	96:xJi3gPnVW48D1vDN6vcdvsYIg7Eug9fO4KB94BnjuwBOjc+guoNpoqEV3vj9x4Q:xJiOEB6kdvsYHgQ4KB94lAg+guthvjV
Size:	6779
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Russian.txt
Category:	dropped
Dump:	Readme_Russian.txt.0.dr
ID:	dr_22
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.532839862948336
Encrypted:	false
Ssdeep:	192:fPHUVdVEXTWr9B9UN8xk2bBqsJeov8m/4136sLhVwuYVbKs/M+lk:Hx87qtNm/41qDukKEDlk
Size:	11251
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Spanish.txt
Category:	dropped
Dump:	Readme_Spanish.txt.0.dr
ID:	dr_24
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.670600412205347
Encrypted:	false
Ssdeep:	192:jxyWXPu8XqpK+4XAxegszjvPXfYoEc+YoXTXRz2h33XPus+Hi:4W/iCZwgoDshH/Ii
Size:	7253
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Setup.exe
Category:	dropped
Dump:	Setup.exe.0.dr
ID:	dr_73
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	5.956380304463204
Encrypted:	false
Ssdeep:	49152:8O7YiGe7FLWNwPkbr09rO73VSREcPpMI3QOywgReywylzBOsgXkSETtULu+qW1aR:NGkLWNwPA0873VSREcPpMGuwgReollOw
Size:	2320464
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
EXE planting / hijacking vulnerabilities found	Privilege Escalation, Compliance	DLL Search Order Hijacking
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Setup.ini
Category:	dropped
Dump:	Setup.ini.0.dr
ID:	dr_74
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.7182427555938387
Encrypted:	false
Ssdeep:	192:w4G+wnFz86dvlp2+MI1aLLNL30QH52qSZp:wD+GZ+L30Q8
Size:	15210
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\EULA\EC_French.txt
Category:	dropped
Dump:	EC_French.txt.0.dr
ID:	dr_26
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with very long lines (1165), with CRLF line terminators
Entropy:	3.548561898148572
Encrypted:	false
Ssdeep:	192:KQUXsuWrOg4aInxvMzUyQwGCxIRKMaQ4W2Thn0n6EpvpmfkqRiHJyMCshAqeAN4j:36g4aKLQIRbZE0n0R0vSsN+
Size:	15268
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\EULA\EC_German.txt
Category:	dropped
Dump:	EC_German.txt.0.dr
ID:	dr_28
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with very long lines (1154), with CRLF line terminators
Entropy:	3.596964066544626
Encrypted:	false
Ssdeep:	192:e9IV5FY9R5vPa0N5IMQHPQ+AKfkqg1JhExlo5c:dVbY9R5XajozIg1P9+
Size:	14720
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\EULA\EC_Italian.txt
Category:	dropped
Dump:	EC_Italian.txt.0.dr
ID:	dr_30
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with very long lines (1028), with CRLF line terminators
Entropy:	3.5384174747523645
Encrypted:	false
Ssdeep:	192:Knz81j5z2Doves6+BvwFCvqRaDkLI5xGdfkqmyqpjk1n3KQT4:B1jD6+4GkLX4js4
Size:	14282
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\EULA\EC_Portuguese.txt
Category:	dropped
Dump:	EC_Portuguese.txt.0.dr
ID:	dr_32
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with very long lines (996), with CRLF line terminators
Entropy:	3.5904498930650592
Encrypted:	false
Ssdeep:	192:KI2rQypJRen0Lq2vS/JCZJ/Rc+UPZxIfcq/2LM676uuuCFCXnM3N8:URReGq2vSxCZsc/Hd3N8
Size:	13416
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\EULA\EC_Russian.txt
Category:	dropped
Dump:	EC_Russian.txt.0.dr
ID:	dr_34
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with very long lines (1182), with CRLF line terminators
Entropy:	4.127101730249165
Encrypted:	false
Ssdeep:	192:8Ia2U2mxtp9C2W1jiLNFVUrHlsrv+G9AM5zEfcqRHCRutyijmiD1T:ha2UBxtp91NFqrStDVaRHCRut/jrpT
Size:	15598
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\EULA\EC_Spanish.txt
Category:	dropped
Dump:	EC_Spanish.txt.0.dr
ID:	dr_36
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with very long lines (1087), with CRLF line terminators
Entropy:	3.5471724731776297
Encrypted:	false
Ssdeep:	192:0G6xfF1ElOwGzSvfeEwZG5aobJovDLTFivfkqBLiNmbmmJT:M3EItSnPpaqJovXJibBhZT
Size:	14076
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\EULA\JP_Japanese.txt
Category:	dropped
Dump:	JP_Japanese.txt.0.dr
ID:	dr_38
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with very long lines (518), with CRLF line terminators
Entropy:	5.491821021477222
Encrypted:	false
Ssdeep:	96:8hdm7UVE+wMJ7JSNkSg29qtOHkNqF2WkJaw1aAimuv2uvuvae7uKYpO:qdm7Ui00UrFWNnwcKf
Size:	5854
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\EULA\US_English.txt
Category:	dropped
Dump:	US_English.txt.0.dr
ID:	dr_50
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with very long lines (993), with CRLF line terminators
Entropy:	3.572779344859941
Encrypted:	false
Ssdeep:	192:QCvzuzwEv1tjtmx0tjP3QyeRUMxnLJJdfkqewqoJ8x4z1k:dzA71tjtmOtjPgyeR7Pbqodk
Size:	12970
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\EULA\US_Korean.txt
Category:	dropped
Dump:	US_Korean.txt.0.dr
ID:	dr_51
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with very long lines (516), with CRLF line terminators
Entropy:	5.442306312388692
Encrypted:	false
Ssdeep:	96:2skIZMhmfs/t98Ea2jcDutin4vTRQl7LGYZtcgsEmYdb7JZnuv2uvuvaeTuqIpyM:Aetfs/t9PjvtiIC7SatcgX3vkqe1n
Size:	7038
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\EULA\US_SimplifiedChinese.txt
Category:	dropped
Dump:	US_SimplifiedChinese.txt.0.dr
ID:	dr_52
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with very long lines (516), with CRLF line terminators
Entropy:	6.4059931106650145
Encrypted:	false
Ssdeep:	96:K/3Hg5yECK6jhuHK0PEVs0Wnuv2uvuvaeTuqIpwOqwg:8wiTMq0PT0Wvkq7t3
Size:	4524
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\STRING\EC_French.ini
Category:	dropped
Dump:	EC_French.ini.0.dr
ID:	dr_53
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.528178436006482
Encrypted:	false
Ssdeep:	6:Q+slqGldxYHse4FO3d5K4dribYHfK4dxYHujSe4FcsQKlB4dxYHLXUlpe3PEyONv:Q+swGet4L0fquH4K8QDe38yON
Size:	388
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\STRING\EC_German.ini
Category:	dropped
Dump:	EC_German.ini.0.dr
ID:	dr_54
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.528178436006482
Encrypted:	false
Ssdeep:	6:Q+slqGldxYHse4FO3d5K4dribYHfK4dxYHujSe4FcsQKlB4dxYHLXUlpe3PEyONv:Q+swGet4L0fquH4K8QDe38yON
Size:	388
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\STRING\EC_Italian.ini
Category:	dropped
Dump:	EC_Italian.ini.0.dr
ID:	dr_55
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.528178436006482
Encrypted:	false
Ssdeep:	6:Q+slqGldxYHse4FO3d5K4dribYHfK4dxYHujSe4FcsQKlB4dxYHLXUlpe3PEyONv:Q+swGet4L0fquH4K8QDe38yON
Size:	388
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\STRING\EC_Portuguese.ini
Category:	dropped
Dump:	EC_Portuguese.ini.0.dr
ID:	dr_56
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.528178436006482
Encrypted:	false
Ssdeep:	6:Q+slqGldxYHse4FO3d5K4dribYHfK4dxYHujSe4FcsQKlB4dxYHLXUlpe3PEyONv:Q+swGet4L0fquH4K8QDe38yON
Size:	388
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\STRING\EC_Russian.ini
Category:	dropped
Dump:	EC_Russian.ini.0.dr
ID:	dr_57
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.528178436006482
Encrypted:	false
Ssdeep:	6:Q+slqGldxYHse4FO3d5K4dribYHfK4dxYHujSe4FcsQKlB4dxYHLXUlpe3PEyONv:Q+swGet4L0fquH4K8QDe38yON
Size:	388
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\STRING\EC_Spanish.ini
Category:	dropped
Dump:	EC_Spanish.ini.0.dr
ID:	dr_58
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.528178436006482
Encrypted:	false
Ssdeep:	6:Q+slqGldxYHse4FO3d5K4dribYHfK4dxYHujSe4FcsQKlB4dxYHLXUlpe3PEyONv:Q+swGet4L0fquH4K8QDe38yON
Size:	388
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\STRING\JP_Japanese.ini
Category:	dropped
Dump:	JP_Japanese.ini.0.dr
ID:	dr_59
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.8925345913000458
Encrypted:	false
Ssdeep:	6:Q+slqGldxYHse4FO3d5K4dribYHfK4dxYHujSe4PxYHLXUlpe9N8xv:Q+swGet4L0fquH4GQDe9M
Size:	362
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\STRING\US_English.ini
Category:	dropped
Dump:	US_English.ini.0.dr
ID:	dr_70
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.528178436006482
Encrypted:	false
Ssdeep:	6:Q+slqGldxYHse4FO3d5K4dribYHfK4dxYHujSe4FcsQKlB4dxYHLXUlpe3PEyONv:Q+swGet4L0fquH4K8QDe38yON
Size:	388
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\STRING\US_Korean.ini
Category:	dropped
Dump:	US_Korean.ini.0.dr
ID:	dr_71
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.528178436006482
Encrypted:	false
Ssdeep:	6:Q+slqGldxYHse4FO3d5K4dribYHfK4dxYHujSe4FcsQKlB4dxYHLXUlpe3PEyONv:Q+swGet4L0fquH4K8QDe38yON
Size:	388
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\STRING\US_SimplifiedChinese.ini
Category:	dropped
Dump:	US_SimplifiedChinese.ini.0.dr
ID:	dr_72
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.528178436006482
Encrypted:	false
Ssdeep:	6:Q+slqGldxYHse4FO3d5K4dribYHfK4dxYHujSe4FcsQKlB4dxYHLXUlpe3PEyONv:Q+swGet4L0fquH4K8QDe38yON
Size:	388
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\ANIMIMG\USBANIM.AV_
Category:	dropped
Dump:	USBANIM.AV_.0.dr
ID:	dr_75
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	MS Compress archive data, SZDD variant, i is last character of original name, original size: 2396160 bytes
Entropy:	7.711534353747695
Encrypted:	false
Ssdeep:	12288:gGngoyx+UmyuUksGOZjldqSC2EVxqn5cQCa7Oki3Tj3osR0e4qEbHKCg+C3:gmt2Tk6jlAZxE5BRE3Tj3oE0eQdI
Size:	668217
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\DDI\CNWIDSCK.dll
Category:	dropped
Dump:	CNWIDSCK.dll.0.dr
ID:	dr_78
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.922141063668167
Encrypted:	false
Ssdeep:	3072:KzKuJY/pIPN0qsHrzTYa39Wgt0PmhM7kR1tB7kCLrldvqVj:KzKuJY/WPN0RLg0W+0YXtF
Size:	155648
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\DDI\CNWIDSK.INI
Category:	dropped
Dump:	CNWIDSK.INI.0.dr
ID:	dr_79
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Generic INItialization configuration [OLDCONFIG]
Entropy:	4.697189332717237
Encrypted:	false
Ssdeep:	24:AHzGas1dYMm1DXt34Z601B/V+iws6FhnF2Q5hZz99/0dbAHJ9/hxcC4xlY/M8hHa:uxlCwFDb5HhV40TlZGm3SGDJ+h
Size:	1728
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\DDI\XML\SLPDiscoveryGA1.xml
Category:	dropped
Dump:	SLPDiscoveryGA1.xml.0.dr
ID:	dr_90
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.91428408169398
Encrypted:	false
Ssdeep:	384:Pr1rorlrJqrrrkrjrcr6rrrorLryr1rgr5rUrXrHrqrLr1rBr4rLrLrTr2rYrVrQ:D9ct8XQf4SXc369EpAbLC39hs33PWMdQ
Size:	14964
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\DDI\XML\SNMPDiscoveryGA1.xml
Category:	dropped
Dump:	SNMPDiscoveryGA1.xml.0.dr
ID:	dr_91
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	exported SGML document, ASCII text, with CRLF line terminators
Entropy:	4.952648426701481
Encrypted:	false
Ssdeep:	384:h1r1rorlrJqrrrkrjrcr6rrrorLryr1rgr5rUrXrHrqrLr8rBr4rLrLrTr2rYrV0:b9ct8XQf4SXc369EpAbLC3Yhs33PWMdQ
Size:	15230
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\DDI\cnwdsck6.dll
Category:	dropped
Dump:	cnwdsck6.dll.0.dr
ID:	dr_77
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.776346671546614
Encrypted:	false
Ssdeep:	768:YtlADJIAjKCV7mpzsN4FhVznbnUYKNYUkpYtxIXLAQ/OV2rJrZXgOv:VU0yVO4HJ7UYKNYUggx2s8rZH
Size:	48128
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\ENVINI.INI
Category:	dropped
Dump:	ENVINI.INI.0.dr
ID:	dr_92
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Generic INItialization configuration [Canon iPF770_x64]
Entropy:	5.065073998722065
Encrypted:	false
Ssdeep:	12:fr32ZbsGSTcXCwAUC32T3sGSTcXCwAA32Yt3sGSTcXCwAz:TGqncX3aGTcncX3lGYtcncX3m
Size:	522
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAC.RTF
Category:	dropped
Dump:	EULAC.RTF.0.dr
ID:	dr_93
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	4.5160153751975765
Encrypted:	false
Ssdeep:	384:nbATNefcAmBtnBgL42+AVCVy9xurgkCuNUFaWHBOMCnEUWc38vUUvvOXMe5icC2r:nbOkoXJ
Size:	33353
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAF.RTF
Category:	dropped
Dump:	EULAF.RTF.0.dr
ID:	dr_94
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	5.182692740680335
Encrypted:	false
Ssdeep:	384:BSELrUUnvrB9woxgsaMqcTOfVUcgBWF3BktTRtElDqmWN+aVUoV1TEaRONlmG+Ds:xrUUnvrB9woxgsaMqcTOfVUcgBWF3Bkm
Size:	22343
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAG.RTF
Category:	dropped
Dump:	EULAG.RTF.0.dr
ID:	dr_95
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	5.2915764720129514
Encrypted:	false
Ssdeep:	384:DlfnyDmjVYA2atcar2yr3x41J151wRdwhK1f8iGOd1X/:D1nySjVH2atcaqox41J151gehK58iGOP
Size:	21119
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAI.RTF
Category:	dropped
Dump:	EULAI.RTF.0.dr
ID:	dr_96
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	5.249640519280235
Encrypted:	false
Ssdeep:	384:163Ovmw3CMSNu5YRpRYYGavN+6kVYvvQ7rKa8Qdgav3jIS9JS1/NO+YGJzA9vnDv:83Ovmw3hSNu5YRpRYYGavN+6kVcvQ7rL
Size:	19435
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAJ.RTF
Category:	dropped
Dump:	EULAJ.RTF.0.dr
ID:	dr_97
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	4.522092372336813
Encrypted:	false
Ssdeep:	384:gQAboFf/cqIAIWevR/B3I9kRvqCsLqs3A+BXy+ML00g7c:GboFXmAIl34qvq1YLM4
Size:	33849
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAO.RTF
Category:	dropped
Dump:	EULAO.RTF.0.dr
ID:	dr_98
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	4.08707002465212
Encrypted:	false
Ssdeep:	384:k646R96z2t+4t7mWsfKPCav30KK7V/7hiDA64sxFbkjwYdyFIoYD8wYeM5/kmSAO:k646KaMSPZhX4jYFIogs93eEG1GRM
Size:	114674
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAP.RTF
Category:	dropped
Dump:	EULAP.RTF.0.dr
ID:	dr_99
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	5.219985529023853
Encrypted:	false
Ssdeep:	384:a9b5mhRbEbfTlqAJvWP4oi+ze6K8QbQIl38:a9b5mhRbEbLlqAJ8ti+wnZl38
Size:	23104
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAR.RTF
Category:	dropped
Dump:	EULAR.RTF.0.dr
ID:	dr_110
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Entropy:	3.5849320390259494
Encrypted:	false
Ssdeep:	384:Nzof6qsV7zJMJVNK7WKJMthqFAEKj2yhDBVsorro3tsW0fkoZ1RYVC4NIGQz0lYm:NA6qsaV6WCs2W/RU50fCePMP/6G
Size:	26662
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAS.RTF
Category:	dropped
Dump:	EULAS.RTF.0.dr
ID:	dr_111
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	5.210347327390985
Encrypted:	false
Ssdeep:	384:INsmxwwXM0Ps0Iq1I/x2xIaNjV+dHFxqEA/BTT7TK1IxiudP7SbV4Tle0PTWn6TE:osmWwXZPs0Iq1Ipg1pV+dH3qEA/BTT78
Size:	21959
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAU.RTF
Category:	dropped
Dump:	EULAU.RTF.0.dr
ID:	dr_112
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	5.367633225037607
Encrypted:	false
Ssdeep:	192:AASsuY1o6FRC1g94rsN/qNIOhOKTPM9BxXLZLAU3VASc/WdLDsdNMNLJMIsPZ3TI:BSELzCI4LTk3Yjt/WdvLJuFc3
Size:	17363
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\INSDRV.INI
Category:	dropped
Dump:	INSDRV.INI.0.dr
ID:	dr_114
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Generic INItialization configuration [DriverSetPath]
Entropy:	5.444204508632964
Encrypted:	false
Ssdeep:	24:HGOVEk3uDX8Q1eqFmCpcVnmCybKVddzqu1Rvd4go+RdxP4adp44vQXJlC3AETtuC:HGOVEkEnFk5y4nEOvQXJUlTtz
Size:	1759
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\InsCmn.dll
Category:	dropped
Dump:	InsCmn.dll.0.dr
ID:	dr_113
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	6.109606907303908
Encrypted:	false
Ssdeep:	6144:TN9jLwwNwOSqSpUscAXN85SH4Sy2tiZonDOGJZYnEOW2No9ZOzuHJWYe5Mu2Lg7F:nLfJjYUs/0wWCn/So9KuIhos
Size:	672256
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIC.dll
Category:	dropped
Dump:	SetupUIC.dll.0.dr
ID:	dr_115
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.363376377105372
Encrypted:	false
Ssdeep:	12288:TEzCLvvbnkg2Xnz6K7jYBcgcB5rCjNhcbB:4zt/Xnz6lcg25W5O
Size:	994304
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIF.dll
Category:	dropped
Dump:	SetupUIF.dll.0.dr
ID:	dr_116
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.318109532048645
Encrypted:	false
Ssdeep:	12288:oEkOLvvbnkg2Xnz6K7jYBcgcB5rCjNhcbB:zkJ/Xnz6lcg25W5O
Size:	1032192
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIG.dll
Category:	dropped
Dump:	SetupUIG.dll.0.dr
ID:	dr_117
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.315385226877313
Encrypted:	false
Ssdeep:	12288:CEc5Lvvbnkg2Xnz6K7jYBcgcB5rCjNhcbB5:Fcu/Xnz6lcg25W5O5
Size:	1033216
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUII.dll
Category:	dropped
Dump:	SetupUII.dll.0.dr
ID:	dr_118
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.316245214551309
Encrypted:	false
Ssdeep:	12288:NEg8Lvvbnkg2Xnz6K7jYBcgcB5rCjNhcbB:6gn/Xnz6lcg25W5O
Size:	1030656
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIJ.dll
Category:	dropped
Dump:	SetupUIJ.dll.0.dr
ID:	dr_119
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.378075939199795
Encrypted:	false
Ssdeep:	12288:SE/GLvvbn9Zg2Xnz65jYBcgcB5rCjNhcbB:V/i/Xnz6scg25W5O
Size:	1003008
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIO.dll
Category:	dropped
Dump:	SetupUIO.dll.0.dr
ID:	dr_130
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.369494846901261
Encrypted:	false
Ssdeep:	12288:rE8iLvvbnkg2Xnz6K7jYBcgcB5rCjNhcbB:Q8N/Xnz6lcg25W5O
Size:	1002496
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIP.dll
Category:	dropped
Dump:	SetupUIP.dll.0.dr
ID:	dr_131
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.317525491061716
Encrypted:	false
Ssdeep:	12288:qElWLvvbnkg2Xnz6K7jYBcgcB5rCjNhcbB:tlh/Xnz6lcg25W5O
Size:	1027072
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIR.dll
Category:	dropped
Dump:	SetupUIR.dll.0.dr
ID:	dr_132
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.414920743667683
Encrypted:	false
Ssdeep:	12288:4EpPLvvbnkg2Xnz6K7jYBcgcB5rCjNhcbB:Dp8/Xnz6lcg25W5O
Size:	1024512
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIS.dll
Category:	dropped
Dump:	SetupUIS.dll.0.dr
ID:	dr_133
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.317102787821746
Encrypted:	false
Ssdeep:	12288:2EM5Lvvbnkg2Xnz6K7jYBcgcB5rCjNhcbB:BMu/Xnz6lcg25W5O
Size:	1032192
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIU.dll
Category:	dropped
Dump:	SetupUIU.dll.0.dr
ID:	dr_134
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.318158054736587
Encrypted:	false
Ssdeep:	12288:1EOrLvvbnkg2Xnz6K7jYBcgcB5rCjNhcbB:iOI/Xnz6lcg25W5O
Size:	1024000
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UNINSTAL.exe
Category:	dropped
Dump:	UNINSTAL.exe.0.dr
ID:	dr_136
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy:	6.021635951211469
Encrypted:	false
Ssdeep:	24576:HNHh4jT48625bruHzrN7fGdOBh5tVJycLc2X4WFrKWF1cPTLCng9CmjviDFc:j4ykrGqAF12LCn8CmjviDW
Size:	1656928
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
EXE planting / hijacking vulnerabilities found	Privilege Escalation, Compliance	DLL Search Order Hijacking
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIC.dll
Category:	dropped
Dump:	UninsUIC.dll.0.dr
ID:	dr_137
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	4.3191843250589725
Encrypted:	false
Ssdeep:	3072:UThN6x1rm2OunsGLarYHWDqD+lpZAAqOa7s1xFxt31oP29Sm7xyBLwWouJ:UNN2RopLrDT7AXPQjDjAs3ygu
Size:	349184
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIF.dll
Category:	dropped
Dump:	UninsUIF.dll.0.dr
ID:	dr_138
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	4.3023613144132
Encrypted:	false
Ssdeep:	3072:pThN6x1rm2Ox7sGLuJcrYHWDqD+lpZAAqOa7s1xFxt31oP29Sm7xyBLwWouOA:pNN2RoGLJWrDT7AXPQjDjAs3ygu
Size:	356352
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIG.dll
Category:	dropped
Dump:	UninsUIG.dll.0.dr
ID:	dr_139
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	4.306839735841177
Encrypted:	false
Ssdeep:	3072:qThN6x1rm2OCXsGLtrYHWDqD+lpZAAqOa7s1xFxt31oP29Sm7xyBLwWou/VXCXJl:qNN2RoRSrDT7AXPQjDjAs3ygu
Size:	356352
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUII.dll
Category:	dropped
Dump:	UninsUII.dll.0.dr
ID:	dr_150
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	4.29990539645369
Encrypted:	false
Ssdeep:	3072:WThN6x1rm2OsJsGLjrYHWDqD+lpZAAqOa7s1xFxt31oP29Sm7xyBLwWou2W:WNN2RoV8rDT7AXPQjDjAs3ygu
Size:	355840
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIJ.dll
Category:	dropped
Dump:	UninsUIJ.dll.0.dr
ID:	dr_151
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	4.335631118730173
Encrypted:	false
Ssdeep:	3072:MlhN6x1rm2OiS8nLorYHWDqD+lpZAAqOa7s1xFxt31oP29Sm7xyBLwWouNiJ:MDN2Ro8GrDT7AXPQjDjAs3ygu
Size:	350720
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIO.dll
Category:	dropped
Dump:	UninsUIO.dll.0.dr
ID:	dr_152
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	4.327030019446202
Encrypted:	false
Ssdeep:	3072:BThN6x1rm2OxssGLRrYHWDqD+lpZAAqOa7s1xFxt31oP29Sm7xyBLwWouZ0t:BNN2RoVurDT7AXPQjDjAs3yguZ0
Size:	350720
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIP.dll
Category:	dropped
Dump:	UninsUIP.dll.0.dr
ID:	dr_153
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	4.3044721327159
Encrypted:	false
Ssdeep:	3072:1lhN6x1rm2OPy8nLYrYHWDqD+lpZAAqOa7s1xFxt31oP29Sm7xyBLwWouGa:1DN2RolGrDT7AXPQjDjAs3ygu
Size:	355328
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIR.dll
Category:	dropped
Dump:	UninsUIR.dll.0.dr
ID:	dr_154
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	4.365528280626483
Encrypted:	false
Ssdeep:	3072:pThN6x1rm2O6SsGLUrYHWDqD+lpZAAqOa7s1xFxt31oP29Sm7xyBLwWouuC:pNN2RowlrDT7AXPQjDjAs3ygu
Size:	354304
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIS.dll
Category:	dropped
Dump:	UninsUIS.dll.0.dr
ID:	dr_155
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	4.302566109161349
Encrypted:	false
Ssdeep:	3072:5ThN6x1rm2OemsGLprYHWDqD+lpZAAqOa7s1xFxt31oP29Sm7xyBLwWouzW:5NN2RoAKrDT7AXPQjDjAs3ygu
Size:	355840
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIU.dll
Category:	dropped
Dump:	UninsUIU.dll.0.dr
ID:	dr_156
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	4.2976623886474945
Encrypted:	false
Ssdeep:	3072:qThN6x1rm2Ob3sGLej/rYHWDqD+lpZAAqOa7s1xFxt31oP29Sm7xyBLwWouWczXj:qNN2RoQbfrDT7AXPQjDjAs3ygu
Size:	354304
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\Uninst.ini
Category:	dropped
Dump:	Uninst.ini.0.dr
ID:	dr_135
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Generic INItialization configuration [Profiles]
Entropy:	5.263433550442916
Encrypted:	false
Ssdeep:	48:CaVolyOBdaf6QbB5qyhSfQBzkLTuozBg3GiZ1nHRvIbX3fmJgVvW:CaGrwAxLaAByHRAmAO
Size:	2813
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\CHECKSUM
Category:	dropped
Dump:	CHECKSUM0.0.dr
ID:	dr_157
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.144498723323622
Encrypted:	false
Ssdeep:	24:cpTLmgewlSQYCECTp0xvnH+VTmSU9wHQmAGopE7mKyAqtLOHFU1bkZ:cZLmXHCEO0xne3UaHQ3GvCAELW1Z
Size:	1776
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\100\cnwgdi10.hdi
Category:	dropped
Dump:	cnwgdi10.hdi.0.dr
ID:	dr_170
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.871383168285089
Encrypted:	false
Ssdeep:	1536:eFF8elBc7qq8ApI789h1MxMhfEGM1WMi61y/6wM1BIFOlWG:HeOq3qII3qkSW761y/6r2FOlWG
Size:	80384
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\101\cnwgdi10.hdi
Category:	dropped
Dump:	cnwgdi10.hdi0.0.dr
ID:	dr_171
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.3683516337531145
Encrypted:	false
Ssdeep:	3072:LAO4RkrUyrPAj0v3Bgr/MB8nOlgf19t19tdkf19t19tdXf19t19tdBf19t19td/O:LAdeJB3e/MEOlgSZfB
Size:	128512
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\102\cnwgdi10.hdi
Category:	dropped
Dump:	cnwgdi10.hdi1.0.dr
ID:	dr_172
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.9057698804489895
Encrypted:	false
Ssdeep:	1536:ZZnxq2t1HJCzQydJ5BYIyEwpXhUqNwrNOp7qyaeSrI:/noiHJkQyrYxWlBOp7qyaeSrI
Size:	82944
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\110\cnwgdi11.hdi
Category:	dropped
Dump:	cnwgdi11.hdi.0.dr
ID:	dr_173
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.846034389205633
Encrypted:	false
Ssdeep:	768:RfeQs1PwyJRrX6Vr0C2A7HlNahsZmfEMlRpuE+eXeV23g68DbVuO68Dy/i06KuHa:RSjX6V0CD7bEJEoneV2vcbicfOO/xAb
Size:	81920
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\111\cnwgdi11.hdi
Category:	dropped
Dump:	cnwgdi11.hdi0.0.dr
ID:	dr_174
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.84603621451744
Encrypted:	false
Ssdeep:	768:yfeQq1PwyJRrX6Vr0C2A7HlNahsZmfEMlRpuE+eXeV23g68D3GyuO68DOji06KuV:y8jX6V0CD7bEJEoneV2vc36cPOO/F37
Size:	81920
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\120\cnwgdi12.hdi
Category:	dropped
Dump:	cnwgdi12.hdi.0.dr
ID:	dr_175
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.818060274293173
Encrypted:	false
Ssdeep:	1536:gP78RpF6hTZWyfmS5P50XT26OOL+zuIZk:+ARp4hTAK75P5J6OOLwZk
Size:	81408
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\91\cnwgdi9.hdi
Category:	dropped
Dump:	cnwgdi9.hdi.0.dr
ID:	dr_176
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.834631857618309
Encrypted:	false
Ssdeep:	1536:d9KDelsGmKiXfiHbG+DfEMpd5AnwOlKm:TKDHLLvUpnAwOlKm
Size:	80384
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\92\cnwgdi9.hdi
Category:	dropped
Dump:	cnwgdi9.hdi0.0.dr
ID:	dr_177
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.8328637646737675
Encrypted:	false
Ssdeep:	1536:AYmdYnGmriMfiniY+Q6EOkrQQYbvHOlv9:jmYLe2hyQbbvOlv9
Size:	80384
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_C.RTF
Category:	dropped
Dump:	EULA_C.RTF.0.dr
ID:	dr_178
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	4.5160153751975765
Encrypted:	false
Ssdeep:	384:nbATNefcAmBtnBgL42+AVCVy9xurgkCuNUFaWHBOMCnEUWc38vUUvvOXMe5icC2r:nbOkoXJ
Size:	33353
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_E.RTF
Category:	dropped
Dump:	EULA_E.RTF.0.dr
ID:	dr_179
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	5.367633225037607
Encrypted:	false
Ssdeep:	192:AASsuY1o6FRC1g94rsN/qNIOhOKTPM9BxXLZLAU3VASc/WdLDsdNMNLJMIsPZ3TI:BSELzCI4LTk3Yjt/WdvLJuFc3
Size:	17363
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_F.RTF
Category:	dropped
Dump:	EULA_F.RTF.0.dr
ID:	dr_190
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	5.182692740680335
Encrypted:	false
Ssdeep:	384:BSELrUUnvrB9woxgsaMqcTOfVUcgBWF3BktTRtElDqmWN+aVUoV1TEaRONlmG+Ds:xrUUnvrB9woxgsaMqcTOfVUcgBWF3Bkm
Size:	22343
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_G.RTF
Category:	dropped
Dump:	EULA_G.RTF.0.dr
ID:	dr_191
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	5.2915764720129514
Encrypted:	false
Ssdeep:	384:DlfnyDmjVYA2atcar2yr3x41J151wRdwhK1f8iGOd1X/:D1nySjVH2atcaqox41J151gehK58iGOP
Size:	21119
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_I.RTF
Category:	dropped
Dump:	EULA_I.RTF.0.dr
ID:	dr_192
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	5.249640519280235
Encrypted:	false
Ssdeep:	384:163Ovmw3CMSNu5YRpRYYGavN+6kVYvvQ7rKa8Qdgav3jIS9JS1/NO+YGJzA9vnDv:83Ovmw3hSNu5YRpRYYGavN+6kVcvQ7rL
Size:	19435
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_J.RTF
Category:	dropped
Dump:	EULA_J.RTF.0.dr
ID:	dr_193
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	4.522092372336813
Encrypted:	false
Ssdeep:	384:gQAboFf/cqIAIWevR/B3I9kRvqCsLqs3A+BXy+ML00g7c:GboFXmAIl34qvq1YLM4
Size:	33849
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_K.RTF
Category:	dropped
Dump:	EULA_K.RTF.0.dr
ID:	dr_194
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	4.08707002465212
Encrypted:	false
Ssdeep:	384:k646R96z2t+4t7mWsfKPCav30KK7V/7hiDA64sxFbkjwYdyFIoYD8wYeM5/kmSAO:k646KaMSPZhX4jYFIogs93eEG1GRM
Size:	114674
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_P.RTF
Category:	dropped
Dump:	EULA_P.RTF.0.dr
ID:	dr_195
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	5.219985529023853
Encrypted:	false
Ssdeep:	384:a9b5mhRbEbfTlqAJvWP4oi+ze6K8QbQIl38:a9b5mhRbEbLlqAJ8ti+wnZl38
Size:	23104
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_R.RTF
Category:	dropped
Dump:	EULA_R.RTF.0.dr
ID:	dr_196
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Entropy:	3.5849320390259494
Encrypted:	false
Ssdeep:	384:Nzof6qsV7zJMJVNK7WKJMthqFAEKj2yhDBVsorro3tsW0fkoZ1RYVC4NIGQz0lYm:NA6qsaV6WCs2W/RU50fCePMP/6G
Size:	26662
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_S.RTF
Category:	dropped
Dump:	EULA_S.RTF.0.dr
ID:	dr_197
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
Entropy:	5.210347327390985
Encrypted:	false
Ssdeep:	384:INsmxwwXM0Ps0Iq1I/x2xIaNjV+dHFxqEA/BTT7TK1IxiudP7SbV4Tle0PTWn6TE:osmWwXZPs0Iq1Ipg1pV+dH3qEA/BTT78
Size:	21959
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Chinese_Simplified.txt
Category:	dropped
Dump:	Readme_Chinese_Simplified.txt0.0.dr
ID:	dr_198
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	4.695589725349978
Encrypted:	false
Ssdeep:	96:YZRUZRwrH1uTCPf4ldWTY8oAHkmOEeKl+3mpMTNT2ci03yWYR2n:YZRUZRKHNfAw8pAHkmOvKyQYJ3yWh
Size:	3946
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_English.txt
Category:	dropped
Dump:	Readme_English.txt0.0.dr
ID:	dr_199
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.4135764447226085
Encrypted:	false
Ssdeep:	192:YZRuN3ZRFCmZnl69hiAHkmOvKwFwvXL6RXSiyF:YZRuN3ZRFzZl69hiAHkmmKQwvXuRByF
Size:	6310
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_French.txt
Category:	dropped
Dump:	Readme_French.txt0.0.dr
ID:	dr_200
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.4117073396598556
Encrypted:	false
Ssdeep:	192:YZRmKSZRT8FDE6awSbAHkmOvKggR3MMLAh8TokJCSjp:YZRmKSZRT866awSbAHkmmKL3MiAhPKp
Size:	7004
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_German.txt
Category:	dropped
Dump:	Readme_German.txt0.0.dr
ID:	dr_201
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.451788819151219
Encrypted:	false
Ssdeep:	192:YZR1ZRA0FmDbK6GqOrm/AHkmOvKjmPt6fEIQ:YZR1ZRA0E/K6sm/AHkmmKjMt6fEIQ
Size:	6780
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Italian.txt
Category:	dropped
Dump:	Readme_Italian.txt0.0.dr
ID:	dr_202
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.389169949855005
Encrypted:	false
Ssdeep:	192:YZRhZRRyXW6a0KmbAHkmOvKPVZB2nQdrLSi7zj:YZRhZRQXW6aAbAHkmmKPzBkQdrGcj
Size:	6736
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Japanese.txt
Category:	dropped
Dump:	Readme_Japanese.txt0.0.dr
ID:	dr_203
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	4.66434000345733
Encrypted:	false
Ssdeep:	48:T+kUn+I7+kaK+u+8hvQ+e+Z+AJ+iO+P+OEH+T+l+v9f+SyPnNvFPEl8+ALAAkNNN:KWXhfePAHkmOEeKl+zyPNdsdAL7ANFH
Size:	4174
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Korean.txt
Category:	dropped
Dump:	Readme_Korean.txt0.0.dr
ID:	dr_204
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	4.665391671767506
Encrypted:	false
Ssdeep:	96:YZRlFZRMEhRQrLkMK6PM9sPAHkmOEeKl+ev/C7UeUwUMVbHOcDS:YZR3ZRMEhRxD6MsPAHkmOvK1IVb2
Size:	4636
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Portuguese.txt
Category:	dropped
Dump:	Readme_Portuguese.txt0.0.dr
ID:	dr_205
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.410894972894707
Encrypted:	false
Ssdeep:	96:YZRg/UVZRCMrKqqH6BQlFYQK6a8eQiDbAHkmOEeKl+qbmPdizb/502LaJZa2uNso:YZRzZRCnRQ6aZbAHkmOvKlBR02LQo
Size:	6506
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Russian.txt
Category:	dropped
Dump:	Readme_Russian.txt0.0.dr
ID:	dr_206
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	4.095276477900739
Encrypted:	false
Ssdeep:	96:YZRYa+ZR3PUmGDOQkK6xOjbAHkmOEeKl+/YVxIk7vjPCspqOlrLse3Lyi:YZREZR3PUmM6EjbAHkmOvKAsD8OlrLV
Size:	6740
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Spanish.txt
Category:	dropped
Dump:	Readme_Spanish.txt0.0.dr
ID:	dr_207
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.391024339972882
Encrypted:	false
Ssdeep:	96:YZRPZapZRl8fAAvgVQB97QK6y0A+abAHkmOEeKl+U1xRuqLG+b2Nb3o/AnNuCLLB:YZR4ZRlJw6AbAHkmOvKTr43dxLLu9vC
Size:	6878
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Setup.exe
Category:	dropped
Dump:	Setup.exe0.0.dr
ID:	dr_208
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy:	5.71748766124663
Encrypted:	false
Ssdeep:	12288:Zui7tkMq4lVdaH00Kk30lNxcMjYBcgcB5rCjNhcbB92:FTq4lVdaH00KfyNcg25W5O92
Size:	562232
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
EXE planting / hijacking vulnerabilities found	Privilege Escalation, Compliance	DLL Search Order Hijacking
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Uninstal.exe
Category:	dropped
Dump:	Uninstal.exe.0.dr
ID:	dr_209
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy:	5.214864595780365
Encrypted:	false
Ssdeep:	6144:wRLtofpznS8anC5Xf63fDZZOM2dpRKvg+rDT7AXPQjDjAs3ygubx:wBtofpbLanCU3fDZ0dHskkjAs3yDbx
Size:	568888
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
EXE planting / hijacking vulnerabilities found	Privilege Escalation, Compliance	DLL Search Order Hijacking
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\cnwgdicp.exe
Category:	dropped
Dump:	cnwgdicp.exe.0.dr
ID:	dr_158
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy:	6.316463168255092
Encrypted:	false
Ssdeep:	49152:FZpf3XZCEH7XJ8G8P+uJo5cM2k06c6rmmbCvhJK+fNH1urvhJDih30EMK:FZiSZRYoypyj+S+fNH1urvhJDW0EMK
Size:	4042808
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
EXE planting / hijacking vulnerabilities found	Privilege Escalation, Compliance	DLL Search Order Hijacking
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\cnwgdicp.ini
Category:	dropped
Dump:	cnwgdicp.ini.0.dr
ID:	dr_159
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Generic INItialization configuration [SupportLanguage]
Entropy:	5.139094287137588
Encrypted:	false
Ssdeep:	24:yWMIQz0I/Nj8R4v986m8e74DsaV+4/SRyocKnQt30xRkTeXomioRxi:y3dyyl8z8eWLV+4/SRXcKnQt3CRkTz
Size:	1983
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Setup.exe
Category:	dropped
Dump:	Setup.exe1.0.dr
ID:	dr_210
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy:	5.509918202481575
Encrypted:	false
Ssdeep:	49152:NqS17LSEKfxInrs7aVFyBpBpWxXbyE+DoL6Dky7WISWz2M0phGHPAbIO1gDPnJcf:NLjFNwStZDIOuDhcgD5O1
Size:	6114400
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
EXE planting / hijacking vulnerabilities found	Privilege Escalation, Compliance	DLL Search Order Hijacking
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Setup.ini
Category:	dropped
Dump:	Setup.ini0.0.dr
ID:	dr_212
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Type:	Generic INItialization configuration [SupportOS]
Entropy:	5.138456939834351
Encrypted:	false
Ssdeep:	6:9qDwg7a3iCqUdFUKJBG5IooIuUaMmymUDkov8xvQ/L2v1ln:9JabCqUduj+GQvQ/Qn
Size:	291
Whitelisted:	false
Reputation:	timeout

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe

Files

Processes

URLs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportSecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe

Files

Processes

URLs

Memdumps

IOC Report
SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe