Automated Malware Analysis IOC Report for

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.764291052511955
Filename:	teracopy.exe
Filesize:	12403216
MD5:	d704e453e065a23ed414927d9b203086
SHA1:	352e4b98faebc35f5c8cfeaebb7bcb36d7c7fbfc
SHA256:	ac03db52bb68a013d3a8bf4db703ec11976fa1d0aa557eb988e3f926a26656cf
SHA512:	0ec2c8cd14a7f4dfd704b19729239ee78e54fc1fb87ba1a2a80da4b7d595fd573861271ca220c3a7b264209ceed1ca96da12d6bdf2b34c35771790cd6337cf49
SSDEEP:	196608:AAKBx4px+sN23RSEfvYfXf1v3j+FX3/yXg3Kf5T72gFUbUamFbSf4k5EBGUQ:AAK/4px/23bfvYvf1bI/8RfVGwdFbSfD
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E...........................................................l...................................8=......8=@.......(.....8=.....

Signature Hits	Behavior Group	Mitre Attack
Tries to harvest and steal ftp login credentials	Stealing of Sensitive Information	OS Credential Dumping Data from Local System
Adds / modifies Windows certificates	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Checks for available system drives (often done to infect USB drives)	Spreading	Replication Through Removable Media Peripheral Device Discovery
Checks if the current process is being debugged	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Drops PE files	Persistence and Installation Behavior
Drops PE files to the application program directory (C:\ProgramData)	Persistence and Installation Behavior
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior	Masquerading
EXE planting / hijacking vulnerabilities found	Privilege Escalation, Compliance	DLL Side-Loading DLL Search Order Hijacking
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the installation date of Windows	Language, Device and Operating System Detection	System Information Discovery
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Uses 32bit PE files	Compliance, System Summary
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Checks the free space of harddrives	Malware Analysis System Evasion
Creates files inside the user directory	System Summary
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads ini files	System Summary
Reads software policies	System Summary
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
PE file has a big raw section	System Summary
Creates license or readme file	Compliance, Persistence and Installation Behavior
PE / OLE file has a valid certificate	Compliance, System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Directory Opus.txt
Category:	dropped
Dump:	Directory Opus.txt.0.dr
ID:	dr_74
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.093924084992883
Encrypted:	false
Size:	917
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to harvest and steal ftp login credentials	Stealing of Sensitive Information	Data from Local System OS Credential Dumping

Details

File:	C:\$Recycle.Bin\S-1-5-18\desktop.ini
Category:	dropped
Dump:	desktop.ini.18.dr
ID:	dr_175
Target ID:	18
Process:	C:\Windows\SysWOW64\msiexec.exe
Type:	Windows desktop.ini
Entropy:	5.323600488446077
Encrypted:	false
Size:	129
Whitelisted:	false

Details

File:	C:\Config.Msi\4a89ab.rbs
Category:	dropped
Dump:	4a89ab.rbs.3.dr
ID:	dr_150
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	6.641360744849574
Encrypted:	false
Size:	1879468
Whitelisted:	false

Details

File:	C:\Config.Msi\4a89ad.rbs
Category:	dropped
Dump:	4a89ad.rbs.3.dr
ID:	dr_153
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	5.272939453098405
Encrypted:	false
Size:	525
Whitelisted:	false

Details

File:	C:\Program Files\TeraCopy\App\DefaultData\PowerOff.cmd
Category:	dropped
Dump:	PowerOff.cmd.3.dr
ID:	dr_161
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	DOS batch file, ASCII text, with CRLF line terminators
Entropy:	5.083767071515677
Encrypted:	false
Size:	279
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\af\default.po
Category:	dropped
Dump:	default.po16.3.dr
ID:	dr_163
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.6819349542497894
Encrypted:	false
Size:	13256
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\ar\default.mo
Category:	dropped
Dump:	default.mo10.3.dr
ID:	dr_164
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 269 messages, Project-Id-Version: teracopy '%s \331\205\331\204\331\201 \330\255\331\201\330\270 hash'
Entropy:	5.251159395479645
Encrypted:	false
Size:	19904
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\bg\default.mo
Category:	dropped
Dump:	default.mo11.3.dr
ID:	dr_165
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 140 messages, Project-Id-Version: teracopy '\320\227\320\260 \320\277\321\200\320\276\320\263\321\200\320\260\320\274\320\260\321\202\320\260'
Entropy:	5.23171823034504
Encrypted:	false
Size:	11248
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\ca\default.mo
Category:	dropped
Dump:	default.mo6.3.dr
ID:	dr_133
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 268 messages, Project-Id-Version: teracopy '%d element\011'
Entropy:	4.983468289293194
Encrypted:	false
Size:	17981
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\cs\default.po
Category:	dropped
Dump:	default.po17.3.dr
ID:	dr_166
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.798021937784084
Encrypted:	false
Size:	13515
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\da\default.mo
Category:	dropped
Dump:	default.mo12.3.dr
ID:	dr_167
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d element'
Entropy:	4.997526165866252
Encrypted:	false
Size:	16763
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\de\default.mo
Category:	dropped
Dump:	default.mo13.3.dr
ID:	dr_168
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d Element'
Entropy:	5.019368586779337
Encrypted:	false
Size:	17249
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\el\default.mo
Category:	dropped
Dump:	default.mo14.3.dr
ID:	dr_169
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \316\243\317\204\316\277\316\271\317\207\316\265\316\257\316\277'
Entropy:	5.25970435117162
Encrypted:	false
Size:	23985
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\es-ES\default.mo
Category:	dropped
Dump:	default.mo15.3.dr
ID:	dr_170
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d elemento'
Entropy:	4.971273169554418
Encrypted:	false
Size:	17896
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\es-ES\default.po
Category:	dropped
Dump:	default.po18.3.dr
ID:	dr_171
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.7838580978435985
Encrypted:	false
Size:	18932
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\es-MX\default.mo
Category:	dropped
Dump:	default.mo7.3.dr
ID:	dr_134
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d elemento'
Entropy:	4.967260060709588
Encrypted:	false
Size:	17894
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\es-MX\default.po
Category:	dropped
Dump:	default.po13.3.dr
ID:	dr_135
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.777490833450184
Encrypted:	false
Size:	18930
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\et\default.po
Category:	dropped
Dump:	default.po14.3.dr
ID:	dr_136
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.796034246202111
Encrypted:	false
Size:	16242
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\he\default.mo
Category:	dropped
Dump:	default.mo.3.dr
ID:	dr_110
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 44 messages, Project-Id-Version: teracopy '\327\224\327\225\327\241\327\243 \327\234\327\252\327\244\327\250\327\231\327\230 \327\241\327\231\327\231\327\250 \327\224\327\227\327\234\327\225\327\240\327\225\327\252'
Entropy:	5.234560893988042
Encrypted:	false
Size:	3189
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\he\default.po
Category:	dropped
Dump:	default.po.3.dr
ID:	dr_111
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.905880063811039
Encrypted:	false
Size:	13585
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\hr\default.po
Category:	dropped
Dump:	default.po0.3.dr
ID:	dr_112
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.848233278494292
Encrypted:	false
Size:	15788
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\id\default.mo
Category:	dropped
Dump:	default.mo0.3.dr
ID:	dr_113
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 188 messages, Project-Id-Version: teracopy '(Membutuhkan akses administrator yang lebih tinggi)'
Entropy:	4.955871097360089
Encrypted:	false
Size:	11855
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\it\default.po
Category:	dropped
Dump:	default.po1.3.dr
ID:	dr_114
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.738289909252582
Encrypted:	false
Size:	18507
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\ja\default.po
Category:	dropped
Dump:	default.po2.3.dr
ID:	dr_115
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF line terminators
Entropy:	5.696209850624636
Encrypted:	false
Size:	20525
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\ko\default.po
Category:	dropped
Dump:	default.po3.3.dr
ID:	dr_116
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.649116224415241
Encrypted:	false
Size:	18703
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\lt\default.mo
Category:	dropped
Dump:	default.mo8.3.dr
ID:	dr_138
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: teracopy
Entropy:	5.452949188493464
Encrypted:	false
Size:	641
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\lt\default.po
Category:	dropped
Dump:	default.po15.3.dr
ID:	dr_139
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, ASCII text, with CRLF, LF line terminators
Entropy:	4.685094910671641
Encrypted:	false
Size:	12693
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\no\default.mo
Category:	dropped
Dump:	default.mo9.3.dr
ID:	dr_140
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d element'
Entropy:	4.970533133068623
Encrypted:	false
Size:	16629
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\pt-BR\default.po
Category:	dropped
Dump:	default.po4.3.dr
ID:	dr_117
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.815341710812011
Encrypted:	false
Size:	18726
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\pt-PT\default.mo
Category:	dropped
Dump:	default.mo1.3.dr
ID:	dr_118
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d item'
Entropy:	4.9864927814469455
Encrypted:	false
Size:	17607
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\pt-PT\default.po
Category:	dropped
Dump:	default.po5.3.dr
ID:	dr_119
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF line terminators
Entropy:	4.8244527116320155
Encrypted:	false
Size:	19482
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\ru\default.po
Category:	dropped
Dump:	default.po6.3.dr
ID:	dr_120
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.299439552979892
Encrypted:	false
Size:	22595
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\sat\default.mo
Category:	dropped
Dump:	default.mo2.3.dr
ID:	dr_121
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 26 messages, Project-Id-Version: teracopy '\341\261\252\341\261\256\341\261\233\341\261\237\341\261\261 \341\261\250\341\261\256 \341\261\233\341\261\237\341\261\246\341\261\256\341\261\270 \341\261\242\341\261\237'
Entropy:	5.1261565866361485
Encrypted:	false
Size:	1810
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\sat\default.po
Category:	dropped
Dump:	default.po7.3.dr
ID:	dr_122
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.823397614765023
Encrypted:	false
Size:	13066
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\sl\default.po
Category:	dropped
Dump:	default.po8.3.dr
ID:	dr_123
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.870975996099702
Encrypted:	false
Size:	18347
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\sr\default.mo
Category:	dropped
Dump:	default.mo3.3.dr
ID:	dr_124
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 43 messages, Project-Id-Version: teracopy '\320\224\320\276\320\264\320\260\321\230 \321\203 \320\272\320\276\320\275\321\202\320\265\320\272\321\201\321\202\321\203\320\260\320\273\320\275\320\276\320\274 \320\274\320\265\320\275\320\270\321\230\321\203 Explorer-\320\260'
Entropy:	5.411303950054313
Encrypted:	false
Size:	3673
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\sr\default.po
Category:	dropped
Dump:	default.po9.3.dr
ID:	dr_125
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.02636217019597
Encrypted:	false
Size:	14063
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\th\default.po
Category:	dropped
Dump:	default.po10.3.dr
ID:	dr_126
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.170869348505211
Encrypted:	false
Size:	20341
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\tr\default.mo
Category:	dropped
Dump:	default.mo4.3.dr
ID:	dr_127
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \303\266\304\237e'
Entropy:	5.13944510194327
Encrypted:	false
Size:	17380
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\tr\default.po
Category:	dropped
Dump:	default.po11.3.dr
ID:	dr_128
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.974121431771883
Encrypted:	false
Size:	18416
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\zh-CN\default.po
Category:	dropped
Dump:	default.po12.3.dr
ID:	dr_129
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.7536227911828375
Encrypted:	false
Size:	17334
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Locale\zh-TW\default.mo
Category:	dropped
Dump:	default.mo5.3.dr
ID:	dr_131
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \345\200\213\351\240\205\347\233\256'
Entropy:	5.767331036551763
Encrypted:	false
Size:	16403
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\App\Sounds\Complete.wav
Category:	dropped
Dump:	Complete.wav.3.dr
ID:	dr_132
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Entropy:	5.137175821839779
Encrypted:	false
Size:	501804
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\Context.dll
Category:	dropped
Dump:	Context.dll.3.dr
ID:	dr_144
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.975108869882995
Encrypted:	false
Size:	1755872
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Spawns processes	System Summary	Process Injection
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\License.rtf
Category:	dropped
Dump:	License.rtf.3.dr
ID:	dr_159
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	Rich Text Format data, version 1, ANSI
Entropy:	4.697765435237592
Encrypted:	false
Size:	1577
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Program Files\TeraCopy\Readme.txt
Category:	dropped
Dump:	Readme.txt.3.dr
ID:	dr_142
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.8248967588728355
Encrypted:	false
Size:	1391
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Program Files\TeraCopy\sorttable.js
Category:	dropped
Dump:	sorttable.js.3.dr
ID:	dr_143
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	4.901143064880864
Encrypted:	false
Size:	17213
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\updater.exe
Category:	dropped
Dump:	updater.exe.3.dr
ID:	dr_156
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.442073850064254
Encrypted:	false
Size:	1213664
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Spawns processes	System Summary	Process Injection
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\updater.ini
Category:	dropped
Dump:	updater.ini.3.dr
ID:	dr_149
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.331139663722829
Encrypted:	false
Size:	397
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Writes ini files	System Summary	File and Directory Discovery
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\Program Files\TeraCopy\xxHashAVX2.dll
Category:	dropped
Dump:	xxHashAVX2.dll.3.dr
ID:	dr_145
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	6.182673321088226
Encrypted:	false
Size:	287456
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading

Details

File:	C:\ProgramData\Caphyon\Advanced Installer\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}\teracopy3.17.exe
Category:	dropped
Dump:	teracopy3.17.exe.10.dr
ID:	dr_173
Target ID:	10
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.764291052511955
Encrypted:	false
Size:	12403216
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Drops PE files to the application program directory (C:\ProgramData)	Persistence and Installation Behavior

Details

File:	C:\ProgramData\Caphyon\Advanced Installer\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}\teracopy3.17.exe:Zone.Identifier
Category:	modified
Dump:	teracopy3.17.exe_Zone.Identifier.10.dr
ID:	dr_172
Target ID:	10
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.95006375643621
Encrypted:	false
Size:	26
Whitelisted:	false

Details

File:	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeraCopy.lnk
Category:	dropped
Dump:	TeraCopy.lnk.3.dr
ID:	dr_148
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Dec 3 10:00:40 2023, mtime=Thu Oct 3 19:54:52 2024, atime=Sun Dec 3 10:00:40 2023, length=4825824, window=hide
Entropy:	4.634472664314333
Encrypted:	false
Size:	976
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\ExternalUICleaner.dll
Category:	dropped
Dump:	ExternalUICleaner.dll.0.dr
ID:	dr_25
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.878784462375495
Encrypted:	false
Size:	295776
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\GSBT.xaml
Category:	dropped
Dump:	GSBT.xaml.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.071410438146583
Encrypted:	false
Size:	849
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\ImageCheckBox.xaml
Category:	dropped
Dump:	ImageCheckBox.xaml.0.dr
ID:	dr_32
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.861580373550762
Encrypted:	false
Size:	292
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\ProgressImage.png
Category:	dropped
Dump:	ProgressImage.png.0.dr
ID:	dr_30
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PNG image data, 172 x 2, 8-bit/color RGBA, non-interlaced
Entropy:	5.813402326168254
Encrypted:	false
Size:	1869
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\TeraCopy.png
Category:	dropped
Dump:	TeraCopy.png.0.dr
ID:	dr_12
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Entropy:	7.842972942954408
Encrypted:	false
Size:	44375
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\aboutbtn
Category:	dropped
Dump:	aboutbtn.0.dr
ID:	dr_21
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PNG image data, 144 x 24, 8-bit/color RGBA, non-interlaced
Entropy:	7.065194573254018
Encrypted:	false
Size:	1632
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\aboutbtn.xaml
Category:	dropped
Dump:	aboutbtn.xaml.0.dr
ID:	dr_33
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.226686182904195
Encrypted:	false
Size:	791
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\aboutbtndark.xaml
Category:	dropped
Dump:	aboutbtndark.xaml.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.238552257328604
Encrypted:	false
Size:	791
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\applogoicon.ico
Category:	dropped
Dump:	applogoicon.ico.0.dr
ID:	dr_23
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	MS Windows icon resource - 9 icons, 256x256, 32 bits/pixel, -128x-128, 32 bits/pixel
Entropy:	2.7060227375504753
Encrypted:	false
Size:	432254
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\applogoicondark.ico
Category:	dropped
Dump:	applogoicondark.ico.0.dr
ID:	dr_24
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	MS Windows icon resource - 9 icons, 256x256, 32 bits/pixel, -128x-128, 32 bits/pixel
Entropy:	2.255419263558884
Encrypted:	false
Size:	432254
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\background
Category:	dropped
Dump:	background.0.dr
ID:	dr_14
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 400x300, components 3
Entropy:	3.901038883532958
Encrypted:	false
Size:	2589
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\backgrounddark
Category:	dropped
Dump:	backgrounddark.0.dr
ID:	dr_18
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 400x300, components 3
Entropy:	3.874486375788142
Encrypted:	false
Size:	2582
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\buttonimgs
Category:	dropped
Dump:	buttonimgs.0.dr
ID:	dr_15
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PNG image data, 624 x 37, 8-bit/color RGBA, non-interlaced
Entropy:	6.266336392363215
Encrypted:	false
Size:	1290
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\buttonimgs.xaml
Category:	dropped
Dump:	buttonimgs.xaml.0.dr
ID:	dr_31
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.950526840686042
Encrypted:	false
Size:	351
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\buttonimgsdark
Category:	dropped
Dump:	buttonimgsdark.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PNG image data, 624 x 37, 8-bit/color RGBA, non-interlaced
Entropy:	6.279089479302763
Encrypted:	false
Size:	1289
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\checkboximgs
Category:	dropped
Dump:	checkboximgs.0.dr
ID:	dr_13
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PNG image data, 192 x 16, 8-bit/color RGB, non-interlaced
Entropy:	6.819982547985948
Encrypted:	false
Size:	1456
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\checkboximgsdark
Category:	dropped
Dump:	checkboximgsdark.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PNG image data, 192 x 16, 8-bit/color RGB, non-interlaced
Entropy:	7.0616862220997065
Encrypted:	false
Size:	1610
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\cmdlinkarrow
Category:	dropped
Dump:	cmdlinkarrow.0.dr
ID:	dr_29
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	MS Windows icon resource - 3 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
Entropy:	3.160430651939096
Encrypted:	false
Size:	2862
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\custominstallbtn
Category:	dropped
Dump:	custominstallbtn.0.dr
ID:	dr_16
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PNG image data, 144 x 28, 8-bit/color RGBA, non-interlaced
Entropy:	7.605863623195678
Encrypted:	false
Size:	914
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\custominstallbtndark
Category:	dropped
Dump:	custominstallbtndark.0.dr
ID:	dr_17
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PNG image data, 144 x 28, 8-bit/color RGBA, non-interlaced
Entropy:	7.642489263867849
Encrypted:	false
Size:	918
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\defaultPrograms.dll
Category:	dropped
Dump:	defaultPrograms.dll.0.dr
ID:	dr_27
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.617535318433651
Encrypted:	false
Size:	177504
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\defaultPrograms.dll_1
Category:	dropped
Dump:	defaultPrograms.dll_1.0.dr
ID:	dr_26
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	6.4017712810613245
Encrypted:	false
Size:	218464
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\dictionarywinui.xaml
Category:	dropped
Dump:	dictionarywinui.xaml.0.dr
ID:	dr_22
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	exported SGML document, ASCII text, with very long lines (702), with CRLF line terminators
Entropy:	5.031022408941319
Encrypted:	false
Size:	17676
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\exclamic
Category:	dropped
Dump:	exclamic.0.dr
ID:	dr_19
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PNG image data, 50 x 69, 8-bit/color RGBA, non-interlaced
Entropy:	7.1338258836706085
Encrypted:	false
Size:	1729
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\info
Category:	dropped
Dump:	info.0.dr
ID:	dr_20
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PNG image data, 50 x 69, 8-bit/color RGBA, non-interlaced
Entropy:	7.371782426816929
Encrypted:	false
Size:	2043
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\infoIconMsi
Category:	dropped
Dump:	infoIconMsi.0.dr
ID:	dr_11
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Entropy:	3.347251063198798
Encrypted:	false
Size:	15086
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6300\lzmaextractor.dll
Category:	dropped
Dump:	lzmaextractor.dll.0.dr
ID:	dr_28
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.878300492350629
Encrypted:	false
Size:	22880
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Temp\AiFilesBackNoImpers_DF5325DF_1F43_4282_85D5_1CA3353E6B13.bak
Category:	dropped
Dump:	AiFilesBackNoImpers_DF5325DF_1F43_4282_85D5_1CA3353E6B13.bak.12.dr
ID:	dr_174
Target ID:	12
Process:	C:\Windows\SysWOW64\msiexec.exe
Type:	data
Entropy:	3.4605948032799687
Encrypted:	false
Size:	1487
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\MSI69C0.tmp
Category:	dropped
Dump:	MSI69C0.tmp.0.dr
ID:	dr_9
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.613404997696155
Encrypted:	false
Size:	738656
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Temp\MSI6A9E.tmp
Category:	dropped
Dump:	MSI6A9E.tmp.0.dr
ID:	dr_10
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.471248400056245
Encrypted:	false
Size:	1104736
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Temp\shi6923.tmp
Category:	dropped
Dump:	shi6923.tmp.0.dr
ID:	dr_8
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	6.043058205786219
Encrypted:	false
Size:	5038592
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Temp\upd5ED1.tmp (copy)
Category:	dropped
Dump:	upd5ED1.tmp.part.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\upd5ED1.tmp.part
Category:	dropped
Dump:	upd5ED1.tmp.part.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.339674299124217
Encrypted:	false
Size:	822
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Blake3.dll
Category:	dropped
Dump:	Blake3.dll0.0.dr
ID:	dr_94
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.417003393811551
Encrypted:	false
Size:	90624
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\Context.dll
Category:	dropped
Dump:	Context.dll.0.dr
ID:	dr_95
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.622116538963222
Encrypted:	false
Size:	1291984
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Detected Delphi use of System.ParamCount	System Summary

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopy.dll
Category:	dropped
Dump:	TeraCopy.dll.0.dr
ID:	dr_96
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.628736457473184
Encrypted:	false
Size:	1171176
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopy.exe
Category:	dropped
Dump:	TeraCopy.exe0.0.dr
ID:	dr_87
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.21108362550264
Encrypted:	false
Size:	3486088
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
EXE planting / hijacking vulnerabilities found	Privilege Escalation, Compliance	DLL Search Order Hijacking
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\32-bit\TeraCopyService.exe
Category:	dropped
Dump:	TeraCopyService.exe.0.dr
ID:	dr_88
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.556293785062301
Encrypted:	false
Size:	215264
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
EXE planting / hijacking vulnerabilities found	Privilege Escalation, Compliance	DLL Search Order Hijacking
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\AppDataFolder\TeraCopy\Ignore\Temp files.txt
Category:	dropped
Dump:	Temp files.txt.0.dr
ID:	dr_81
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.623807081313914
Encrypted:	false
Size:	141
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\AppDataFolder\TeraCopy\Ignore\Video files.txt
Category:	dropped
Dump:	Video files.txt.0.dr
ID:	dr_83
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.807371823591203
Encrypted:	false
Size:	127
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\AppDataFolder\TeraCopy\Scripts\Eject drives.ps1
Category:	dropped
Dump:	Eject drives.ps1.0.dr
ID:	dr_89
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.145494180427928
Encrypted:	false
Size:	745
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\AppDataFolder\TeraCopy\Scripts\Notify via IFTTT.ps1
Category:	dropped
Dump:	Notify via IFTTT.ps1.0.dr
ID:	dr_90
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.196545168465599
Encrypted:	false
Size:	1130
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\AppDataFolder\TeraCopy\Scripts\Notify via Ntfy.ps1
Category:	dropped
Dump:	Notify via Ntfy.ps1.0.dr
ID:	dr_91
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.064109055427305
Encrypted:	false
Size:	1004
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\af\default.mo
Category:	dropped
Dump:	default.mo16.0.dr
ID:	dr_99
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 42 messages, Project-Id-Version: teracopy 'Voeg by Explorer konteks kieslys'
Entropy:	4.993611146038944
Encrypted:	false
Size:	2804
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ar\default.po
Category:	dropped
Dump:	default.po6.0.dr
ID:	dr_58
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.244886228407361
Encrypted:	false
Size:	21371
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\bg\default.po
Category:	dropped
Dump:	default.po1.0.dr
ID:	dr_53
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.222912509853502
Encrypted:	false
Size:	17713
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\bn\default.mo
Category:	dropped
Dump:	default.mo17.0.dr
ID:	dr_100
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \340\246\234\340\246\277\340\246\250\340\246\277\340\246\270\340\246\252\340\246\244\340\247\215\340\246\260'
Entropy:	4.965735557479812
Encrypted:	false
Size:	25707
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\bn\default.po
Category:	dropped
Dump:	default.po7.0.dr
ID:	dr_59
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.979535669135564
Encrypted:	false
Size:	26743
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ca\default.po
Category:	dropped
Dump:	default.po5.0.dr
ID:	dr_57
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.784065583688281
Encrypted:	false
Size:	19165
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\cs\default.mo
Category:	dropped
Dump:	default.mo18.0.dr
ID:	dr_101
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 43 messages, Project-Id-Version: teracopy 'P\305\231idat do kontextov\303\251 nab\303\255dky Pr\305\257zkumn\303\255ka'
Entropy:	5.263652718030776
Encrypted:	false
Size:	3099
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\da\default.po
Category:	dropped
Dump:	default.po13.0.dr
ID:	dr_65
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.804138945052056
Encrypted:	false
Size:	17801
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\de\default.po
Category:	dropped
Dump:	default.po15.0.dr
ID:	dr_67
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.843767658835897
Encrypted:	false
Size:	18309
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\el\default.po
Category:	dropped
Dump:	default.po18.0.dr
ID:	dr_70
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.262861294468051
Encrypted:	false
Size:	25021
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\es-AR\default.mo
Category:	dropped
Dump:	default.mo19.0.dr
ID:	dr_102
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d elemento'
Entropy:	4.964424980477654
Encrypted:	false
Size:	17981
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\es-AR\default.po
Category:	dropped
Dump:	default.po21.0.dr
ID:	dr_78
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.7731749029441985
Encrypted:	false
Size:	19025
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\et\default.mo
Category:	dropped
Dump:	default.mo20.0.dr
ID:	dr_103
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 210 messages, Project-Id-Version: teracopy '%s: l\303\265petatud'
Entropy:	4.963068698001432
Encrypted:	false
Size:	12182
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\fa\default.mo
Category:	dropped
Dump:	default.mo21.0.dr
ID:	dr_104
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 158 messages, Project-Id-Version: teracopy '\330\257\330\261\330\250\330\247\330\261\331\207'
Entropy:	5.3340999727108445
Encrypted:	false
Size:	12035
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\fa\default.po
Category:	dropped
Dump:	default.po14.0.dr
ID:	dr_66
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.293924476065809
Encrypted:	false
Size:	17962
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\fi\default.mo
Category:	dropped
Dump:	default.mo22.0.dr
ID:	dr_105
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d kohde'
Entropy:	5.003578684917916
Encrypted:	false
Size:	17403
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\fi\default.po
Category:	dropped
Dump:	default.po3.0.dr
ID:	dr_55
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.824245116001254
Encrypted:	false
Size:	18439
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\fr\default.mo
Category:	dropped
Dump:	default.mo23.0.dr
ID:	dr_106
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \303\251l\303\251ments'
Entropy:	4.987660555942772
Encrypted:	false
Size:	18113
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\fr\default.po
Category:	dropped
Dump:	default.po4.0.dr
ID:	dr_56
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.794416872869295
Encrypted:	false
Size:	19149
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\hi\default.mo
Category:	dropped
Dump:	default.mo24.0.dr
ID:	dr_107
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 27 messages, Project-Id-Version: teracopy '%d \340\244\265\340\244\270\340\245\215\340\244\244\340\245\201'
Entropy:	5.219188526836207
Encrypted:	false
Size:	2294
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\hi\default.po
Category:	dropped
Dump:	default.po9.0.dr
ID:	dr_61
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.916387202013139
Encrypted:	false
Size:	13494
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\hr\default.mo
Category:	dropped
Dump:	default.mo25.0.dr
ID:	dr_108
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 165 messages, Project-Id-Version: teracopy '(ovo zahtjeva administratorske ovlasti)'
Entropy:	5.049767415071793
Encrypted:	false
Size:	10067
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\hu\default.mo
Category:	dropped
Dump:	default.mo26.0.dr
ID:	dr_109
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 169 messages, Project-Id-Version: teracopy 'N\303\251vjegy'
Entropy:	5.162013660978614
Encrypted:	false
Size:	10837
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\hu\default.po
Category:	dropped
Dump:	default.po10.0.dr
ID:	dr_62
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.9329038125514595
Encrypted:	false
Size:	16285
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\id\default.po
Category:	dropped
Dump:	default.po11.0.dr
ID:	dr_63
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, ASCII text, with CRLF, LF line terminators
Entropy:	4.758265539928012
Encrypted:	false
Size:	16412
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\it\default.mo
Category:	dropped
Dump:	default.mo.0.dr
ID:	dr_34
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d voce'
Entropy:	4.924675616291345
Encrypted:	false
Size:	17471
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ja\default.mo
Category:	dropped
Dump:	default.mo0.0.dr
ID:	dr_35
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 271 messages, Project-Id-Version: teracopy '%d \351\240\205\347\233\256'
Entropy:	5.692796275283653
Encrypted:	false
Size:	18638
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ka\default.mo
Category:	dropped
Dump:	default.mo1.0.dr
ID:	dr_36
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 43 messages, Project-Id-Version: teracopy '\341\203\231\341\203\235\341\203\234\341\203\242\341\203\224\341\203\245\341\203\241\341\203\242\341\203\243\341\203\240 \341\203\233\341\203\224\341\203\234\341\203\230\341\203\243\341\203\250\341\203\230 \341\203\223\341\203\220\341\203\233\341\203\220\341\203\242\341\203\224\341\203\221\341\203\220'
Entropy:	4.956064895514923
Encrypted:	false
Size:	4482
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ka\default.po
Category:	dropped
Dump:	default.po.0.dr
ID:	dr_51
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.013628609954672
Encrypted:	false
Size:	14846
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ko\default.mo
Category:	dropped
Dump:	default.mo2.0.dr
ID:	dr_37
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \355\225\255\353\252\251'
Entropy:	5.669612496353697
Encrypted:	false
Size:	17691
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ms\default.mo
Category:	dropped
Dump:	default.mo3.0.dr
ID:	dr_38
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: teracopy
Entropy:	5.328248002637431
Encrypted:	false
Size:	529
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ms\default.po
Category:	dropped
Dump:	default.po8.0.dr
ID:	dr_60
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, ASCII text, with CRLF, LF line terminators
Entropy:	4.646734211889118
Encrypted:	false
Size:	12503
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\nl\default.mo
Category:	dropped
Dump:	default.mo4.0.dr
ID:	dr_39
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d item'
Entropy:	4.944305465276067
Encrypted:	false
Size:	17384
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\nl\default.po
Category:	dropped
Dump:	default.po2.0.dr
ID:	dr_54
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.758351588661835
Encrypted:	false
Size:	18420
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\no\default.po
Category:	dropped
Dump:	default.po12.0.dr
ID:	dr_64
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.779049693750268
Encrypted:	false
Size:	17665
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\pl\default.mo
Category:	dropped
Dump:	default.mo5.0.dr
ID:	dr_40
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d element'
Entropy:	5.19691860841188
Encrypted:	false
Size:	17722
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\pl\default.po
Category:	dropped
Dump:	default.po17.0.dr
ID:	dr_69
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.04516084252042
Encrypted:	false
Size:	18806
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\pt-BR\default.mo
Category:	dropped
Dump:	default.mo6.0.dr
ID:	dr_41
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d item'
Entropy:	5.005787181181036
Encrypted:	false
Size:	17690
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ro\default.mo
Category:	dropped
Dump:	default.mo7.0.dr
ID:	dr_42
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 272 messages, Project-Id-Version: teracopy '%d element'
Entropy:	5.0368909046923
Encrypted:	false
Size:	17607
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ro\default.po
Category:	dropped
Dump:	default.po16.0.dr
ID:	dr_68
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.865419631816407
Encrypted:	false
Size:	18773
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\ru\default.mo
Category:	dropped
Dump:	default.mo8.0.dr
ID:	dr_43
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \320\276\320\261\321\212\320\265\320\272\321\202'
Entropy:	5.289696670779707
Encrypted:	false
Size:	21509
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\sk\default.mo
Category:	dropped
Dump:	default.mo9.0.dr
ID:	dr_44
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d polo\305\276ka'
Entropy:	5.240024732296052
Encrypted:	false
Size:	18196
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\sk\default.po
Category:	dropped
Dump:	default.po22.0.dr
ID:	dr_79
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.092304395204247
Encrypted:	false
Size:	19280
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\sl\default.mo
Category:	dropped
Dump:	default.mo10.0.dr
ID:	dr_45
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d postavka'
Entropy:	5.033719475181113
Encrypted:	false
Size:	17263
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\sv-SE\default.mo
Category:	dropped
Dump:	default.mo11.0.dr
ID:	dr_46
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d objekt'
Entropy:	5.036979847204208
Encrypted:	false
Size:	16840
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\sv-SE\default.po
Category:	dropped
Dump:	default.po20.0.dr
ID:	dr_77
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	4.8505622187827955
Encrypted:	false
Size:	17876
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\th\default.mo
Category:	dropped
Dump:	default.mo12.0.dr
ID:	dr_47
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 178 messages, Project-Id-Version: teracopy '(\340\271\203\340\270\212\340\271\211\340\271\204\340\270\224\340\271\211\340\271\200\340\270\211\340\270\236\340\270\262\340\270\260\340\270\243\340\270\270\340\271\210\340\270\231\340\271\202\340\270\233\340\270\243)'
Entropy:	5.036455323333889
Encrypted:	false
Size:	15012
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\uk\default.mo
Category:	dropped
Dump:	default.mo13.0.dr
ID:	dr_48
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \320\265\320\273\320\265\320\274\320\265\320\275\321\202'
Entropy:	5.293867731137159
Encrypted:	false
Size:	22157
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\uk\default.po
Category:	dropped
Dump:	default.po23.0.dr
ID:	dr_80
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.301176801033972
Encrypted:	false
Size:	23241
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\vi\default.mo
Category:	dropped
Dump:	default.mo14.0.dr
ID:	dr_49
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 205 messages, Project-Id-Version: teracopy '%s: \304\221\303\243 ho\303\240n th\303\240nh'
Entropy:	5.367375148782935
Encrypted:	false
Size:	12753
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\vi\default.po
Category:	dropped
Dump:	default.po19.0.dr
ID:	dr_71
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.189218638419314
Encrypted:	false
Size:	17033
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\zh-CN\default.mo
Category:	dropped
Dump:	default.mo15.0.dr
ID:	dr_50
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU message catalog (little endian), revision 0.0, 273 messages, Project-Id-Version: teracopy '%d \344\270\252\351\241\271\347\233\256'
Entropy:	5.7565563718733825
Encrypted:	false
Size:	16322
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Locale\zh-TW\default.po
Category:	dropped
Dump:	default.po0.0.dr
ID:	dr_52
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	GNU gettext message catalogue, Unicode text, UTF-8 text, with CRLF, LF line terminators
Entropy:	5.7658486962320685
Encrypted:	false
Size:	17415
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\App\Sounds\Error.wav
Category:	dropped
Dump:	Error.wav.0.dr
ID:	dr_72
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Entropy:	3.9082543423673757
Encrypted:	false
Size:	135552
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Blake3.dll
Category:	dropped
Dump:	Blake3.dll.0.dr
ID:	dr_93
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	6.407622112858739
Encrypted:	false
Size:	162816
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\License.txt
Category:	dropped
Dump:	License.txt.0.dr
ID:	dr_75
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.509786823178353
Encrypted:	false
Size:	1335
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Portable.txt
Category:	dropped
Dump:	Portable.txt.0.dr
ID:	dr_76
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.2499567048116305
Encrypted:	false
Size:	79
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.dll
Category:	dropped
Dump:	TeraCopy.dll0.0.dr
ID:	dr_97
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.946439284223796
Encrypted:	false
Size:	1869544
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.exe
Category:	dropped
Dump:	TeraCopy.exe.0.dr
ID:	dr_86
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy:	7.466669442254551
Encrypted:	false
Size:	4825824
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
EXE planting / hijacking vulnerabilities found	Privilege Escalation, Compliance	DLL Search Order Hijacking

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.msi
Category:	dropped
Dump:	TeraCopy.msi.0.dr
ID:	dr_6
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {C56D35C2-CC91-4532-A3CB-D382D42AD5C2}, Number of Words: 0, Subject: TeraCopy, Author: Code Sector, Name of Creating Application: TeraCopy, Template: ;1033, Comments: This installer database contains the logic and data required to install TeraCopy., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Sun Dec 3 11:04:55 2023, Last Saved Time/Date: Sun Dec 3 11:04:55 2023, Last Printed: Sun Dec 3 11:04:55 2023, Number of Pages: 450
Entropy:	6.2900649822101204
Encrypted:	false
Size:	5838848
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopy.x64.msi
Category:	dropped
Dump:	TeraCopy.x64.msi.0.dr
ID:	dr_7
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {D2625015-F105-4D7F-9742-61C2BD0660E8}, Number of Words: 0, Subject: TeraCopy, Author: Code Sector, Name of Creating Application: TeraCopy, Template: x64;1033, Comments: This installer database contains the logic and data required to install TeraCopy., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Sun Dec 3 11:04:56 2023, Last Saved Time/Date: Sun Dec 3 11:04:56 2023, Last Printed: Sun Dec 3 11:04:56 2023, Number of Pages: 450
Entropy:	6.2900441769357425
Encrypted:	false
Size:	5841408
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\TeraCopyService.exe
Category:	dropped
Dump:	TeraCopyService.exe0.0.dr
ID:	dr_92
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy:	5.980055216713549
Encrypted:	false
Size:	317664
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
EXE planting / hijacking vulnerabilities found	Privilege Escalation, Compliance	DLL Search Order Hijacking

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Total Commander.txt
Category:	dropped
Dump:	Total Commander.txt.0.dr
ID:	dr_82
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.927728678926896
Encrypted:	false
Size:	401
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\Whatsnew.txt
Category:	dropped
Dump:	Whatsnew.txt.0.dr
ID:	dr_84
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.885750246339191
Encrypted:	false
Size:	19505
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\XYplorer.txt
Category:	dropped
Dump:	XYplorer.txt.0.dr
ID:	dr_85
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.97319210070016
Encrypted:	false
Size:	559
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\share.html
Category:	dropped
Dump:	share.html.0.dr
ID:	dr_73
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	HTML document, ASCII text, with CRLF line terminators
Entropy:	5.024775453895666
Encrypted:	false
Size:	751
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\53E6B13\xxHashSSE2.dll
Category:	dropped
Dump:	xxHashSSE2.dll.0.dr
ID:	dr_98
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	6.1909968298841065
Encrypted:	false
Size:	299744
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Roaming\Code Sector\TeraCopy 3.17\install\holder0.aiph
Category:	dropped
Dump:	holder0.aiph.0.dr
ID:	dr_5
Target ID:	0
Process:	C:\Users\user\Desktop\teracopy.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Size:	19111918
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Obsidium x64\{3708183A-73D6E94B-A04B1AB3-BDD30077}.1894784316145562426
Category:	dropped
Dump:	{3708183A-73D6E94B-A04B1AB3-BDD30077}.1894784316145562426.20.dr
ID:	dr_176
Target ID:	20
Process:	C:\Program Files\TeraCopy\TeraCopy.exe
Type:	data
Entropy:	5.9916348537462545
Encrypted:	false
Size:	1600
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\TeraCopy\History\241003-205457-862-878.db
Category:	dropped
Dump:	241003-205457-862-878.db0.20.dr
ID:	dr_184
Target ID:	20
Process:	C:\Program Files\TeraCopy\TeraCopy.exe
Type:	SQLite 3.x database, user version 1, last written using SQLite version 3044002, writer version 2, read version 2, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Entropy:	0.4400474284285706
Encrypted:	false
Size:	12288
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\TeraCopy\History\241003-205457-862-878.db-journal
Category:	dropped
Dump:	241003-205457-862-878.db-journal.20.dr
ID:	dr_178
Target ID:	20
Process:	C:\Program Files\TeraCopy\TeraCopy.exe
Type:	SQLite Rollback Journal
Entropy:	1.062303656645155
Encrypted:	false
Size:	4616
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\TeraCopy\History\241003-205457-862-878.db-shm
Category:	dropped
Dump:	241003-205457-862-878.db-shm.20.dr
ID:	dr_185
Target ID:	20
Process:	C:\Program Files\TeraCopy\TeraCopy.exe
Type:	data
Entropy:	0.03647612055610564
Encrypted:	false
Size:	32768
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\TeraCopy\History\241003-205457-862-878.db-wal
Category:	dropped
Dump:	241003-205457-862-878.db-wal.20.dr
ID:	dr_182
Target ID:	20
Process:	C:\Program Files\TeraCopy\TeraCopy.exe
Type:	SQLite Write-Ahead Log, version 3007000
Entropy:	0.3216029925069804
Encrypted:	false
Size:	8272
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\TeraCopy\PowerOff.cmd (copy)
Category:	dropped
Dump:	PowerOff.cmd.3.dr
Target ID:	20
Process:	C:\Program Files\TeraCopy\TeraCopy.exe
Type:	DOS batch file, ASCII text, with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\TeraCopy\main.db
Category:	dropped
Dump:	main.db.20.dr
ID:	dr_183
Target ID:	20
Process:	C:\Program Files\TeraCopy\TeraCopy.exe
Type:	SQLite 3.x database, last written using SQLite version 3044002, file counter 3, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Entropy:	0.5284548883794503
Encrypted:	false
Size:	8192
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\TeraCopy\main.db-journal
Category:	dropped
Dump:	main.db-journal0.20.dr
ID:	dr_181
Target ID:	20
Process:	C:\Program Files\TeraCopy\TeraCopy.exe
Type:	SQLite Rollback Journal
Entropy:	0.4824046121686224
Encrypted:	false
Size:	8720
Whitelisted:	false

Details

File:	C:\Windows\Installer\MSI8C4D.tmp
Category:	dropped
Dump:	MSI8C4D.tmp.3.dr
ID:	dr_137
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.582068652578541
Encrypted:	false
Size:	858464
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\Installer\MSI9C7C.tmp
Category:	dropped
Dump:	MSI9C7C.tmp.3.dr
ID:	dr_141
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	6.507534058087644
Encrypted:	false
Size:	2124042
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\MSIABB0.tmp
Category:	dropped
Dump:	MSIABB0.tmp.3.dr
ID:	dr_151
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	6.640064596845264
Encrypted:	false
Size:	1709413
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\MSIAC6C.tmp
Category:	dropped
Dump:	MSIAC6C.tmp.3.dr
ID:	dr_152
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.6398518527554735
Encrypted:	false
Size:	854368
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\Installer\SourceHash{DF5325DF-1F43-4282-85D5-1CA3353E6B13}
Category:	dropped
Dump:	SourceHash{DF5325DF-1F43-4282-85D5-1CA3353E6B13}.3.dr
ID:	dr_158
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	3.389723561558948
Encrypted:	false
Size:	32768
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\inprogressinstallinfo.ipi
Category:	dropped
Dump:	inprogressinstallinfo.ipi.3.dr
ID:	dr_162
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.8311191050205071
Encrypted:	false
Size:	20480
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}\TeraCopySmall.exe
Category:	dropped
Dump:	TeraCopySmall.exe.3.dr
ID:	dr_146
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows icon resource - 3 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel
Entropy:	5.51651585000608
Encrypted:	false
Size:	22382
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\{DF5325DF-1F43-4282-85D5-1CA3353E6B13}\ext.exe
Category:	dropped
Dump:	ext.exe.3.dr
ID:	dr_147
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows icon resource - 5 icons, 256x256, 32 bits/pixel, -128x-128, 32 bits/pixel
Entropy:	5.130071348708676
Encrypted:	false
Size:	360414
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Category:	dropped
Dump:	ngen.log.3.dr
ID:	dr_130
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	5.356165555073333
Encrypted:	false
Size:	454234
Whitelisted:	false

Details

File:	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log
Category:	modified
Dump:	MpCmdRun.log.25.dr
ID:	dr_180
Target ID:	25
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.2473301369046137
Encrypted:	false
Size:	4926
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF4151D848D35753D6.TMP
Category:	dropped
Dump:	~DF4151D848D35753D6.TMP.3.dr
ID:	dr_157
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	2.2145291689138396
Encrypted:	false
Size:	40960
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF4EED7D5946988D2D.TMP
Category:	dropped
Dump:	~DF4EED7D5946988D2D.TMP.3.dr
ID:	dr_155
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Size:	512
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF6D6C8C3E43CCAF73.TMP
Category:	dropped
Dump:	~DF6D6C8C3E43CCAF73.TMP.3.dr
ID:	dr_154
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.4464214144982606
Encrypted:	false
Size:	32768
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF7557BAFF32C28170.TMP
Category:	dropped
Dump:	~DF7557BAFF32C28170.TMP.3.dr
ID:	dr_160
Target ID:	3
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.23762485740465858
Encrypted:	false
Size:	73728
Whitelisted:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
teracopy.exe

Files

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportteracopy.exe

Files

Domains

IPs

IOC Report
teracopy.exe