Dropped Files | ZeroBOX

Name	91f71f655004eb5e_services.exe Submit file
Filepath	C:\ProgramData\Microsoft\Windows\WER\services.exe
Size	5.2MB
Processes	3040 (powershell.exe)
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`467d1d12df433e5f6bb45998f05d99df`
SHA1	`32bcb096995acf365f714a1dfc3f131a83e51692`
SHA256	`91f71f655004eb5e2783a98f7556c5e0e58d4f438fd5d2dcdf9e522735cf09b9`
CRC32	`BEFF0CE6`
ssdeep	`98304:HPWAAX3vGNYvdIiYTAL2gMlrV++ytwh+T0QEEr+HZTLVIhJBN68:HgX3k7ytw0T0A+HZTROj68`
Yara	PE_Header_Zero - PE File Signature XMRig_Miner_IN - XMRig Miner Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) Malicious_Library_Zero - Malicious_Library Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file
VirusTotal	Search for analysis

Name	f689ee9af94b00e9_services.exe Submit file
Filepath	C:\ProgramData\Microsoft\Windows\Templates\services.exe
Size	323.5KB
Processes	3040 (powershell.exe)
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`beceae2fdc4f7729a93e94ac2ccd78cc`
SHA1	`47c112c23c7bdf2af24a20bd512f91ff6af76bc6`
SHA256	`f689ee9af94b00e9e3f0bb072b34caaf207f32dcb4f5782fc9ca351df9a06c97`
CRC32	`0B9140C7`
ssdeep	`6144:yejl5QCuDlXW4+DiErv2yKU9pclGrDkXNBe:vl5QCKdW4+DiNlXNBe`
Yara	PE_Header_Zero - PE File Signature Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet IsPE64 - (no description) Malicious_Library_Zero - Malicious_Library Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file
VirusTotal	Search for analysis

Name	11bd2c9f9e2397c9_javacore.sys Submit file
Filepath	C:\ProgramData\Microsoft\Windows\WER\JavaCore.sys
Size	14.2KB
Processes	3040 (powershell.exe)
Type	PE32+ executable (native) x86-64, for MS Windows
MD5	`0c0195c48b6b8582fa6f6373032118da`
SHA1	`d25340ae8e92a6d29f599fef426a2bc1b5217299`
SHA256	`11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5`
CRC32	`6B0323EB`
ssdeep	`192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	a9b1dc8eaa5fcd00_d93f411851d7c929.customdestinations-ms Submit file
Filepath	c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size	7.8KB
Processes	3040 (powershell.exe)
Type	data
MD5	`c1d8708bab1e838a2deda26d58bb8d42`
SHA1	`95d39e75a804752961c139bb6c0b67f84f685035`
SHA256	`a9b1dc8eaa5fcd0034694cf9742ae915a5932142a1477c3ab6fada45d98750b2`
CRC32	`E71AF2A2`
ssdeep	`96:QtuC6GCPDXBqvsqvJCwoFtuC6GCPDXBqvsEHyqvJCworFS7HwxWlUVul:QtbXoFtbbHnor/xo`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis