Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
13-05-2021 12:57
Static task
static1
Behavioral task
behavioral1
Sample
ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe
Resource
win10v20210410
General
-
Target
ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe
-
Size
1.2MB
-
MD5
c2353d76b0b8b87b578e8ce1d2ec7a7a
-
SHA1
3f459642be627f630c7951c09b1490b218fbeffb
-
SHA256
ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334
-
SHA512
8c3e21d652e7cc3663d0cffcc12bd5acf75003787d39363bec3fce7e1373de51252e837cc078bfa9c0ebc83a1553e628a36f685c6d8d9aa2d9b7304774102777
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exedescription ioc process File opened (read-only) \??\O: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\Q: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\T: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\A: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\B: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\E: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\J: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\L: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\W: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\Y: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\Z: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\H: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\M: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\R: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\S: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\V: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\X: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\P: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\U: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\F: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\G: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\I: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\K: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File opened (read-only) \??\N: ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe -
Drops file in System32 directory 10 IoCs
Processes:
ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exedescription ioc process File created C:\Windows\SysWOW64\IME\shared\sperm lesbian .mpeg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\trambling lesbian .avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian fetish fucking lesbian glans .mpg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\SysWOW64\IME\shared\italian handjob trambling [free] feet .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian cum trambling public (Liz).mpeg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\System32\DriverStore\Temp\beast voyeur .mpeg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\SysWOW64\config\systemprofile\lingerie catfight cock leather (Tatjana).mpg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\SysWOW64\FxsTmp\japanese handjob fucking [milf] YEâPSè& .mpg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\SysWOW64\config\systemprofile\american porn gay masturbation glans fishy .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\SysWOW64\FxsTmp\asian sperm hot (!) (Sylvia).rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe -
Drops file in Program Files directory 16 IoCs
Processes:
ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exedescription ioc process File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\russian horse trambling lesbian feet shower (Samantha).rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\bukkake hot (!) hole .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\beast masturbation hole .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files (x86)\Common Files\microsoft shared\gay full movie cock sweet .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\brasilian gang bang horse voyeur feet leather (Karin).avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files (x86)\Microsoft Office\Templates\american porn gay lesbian 50+ .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files\Windows Journal\Templates\bukkake hidden black hairunshaved .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\swedish kicking bukkake voyeur .mpeg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\tyrkish gang bang gay sleeping bedroom (Jenna,Samantha).mpg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files (x86)\Google\Temp\russian cumshot horse [bangbus] .avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files (x86)\Google\Temp\GUMFBCB.tmp\gay voyeur ash .mpeg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files (x86)\Google\Update\Download\lingerie hot (!) feet .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\beast voyeur titts stockings .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files\Common Files\Microsoft Shared\american kicking fucking lesbian femdom .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files\DVD Maker\Shared\danish animal sperm voyeur (Liz).mpeg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\brasilian gang bang beast hidden .avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe -
Drops file in Windows directory 64 IoCs
Processes:
ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exedescription ioc process File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\xxx uncut glans .mpeg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\security\templates\sperm uncut sm .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\american action gay big (Sylvia).avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\danish nude fucking uncut redhair (Kathrin,Jade).zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\american animal gay hot (!) (Curtney).mpeg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\assembly\tmp\lingerie [bangbus] penetration .avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\indian horse hardcore hidden ash (Kathrin,Sarah).avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\bukkake voyeur (Tatjana).zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\nude xxx public boots .mpg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\russian horse fucking sleeping blondie (Britney,Curtney).mpeg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\gay girls Ôë .mpg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\animal sperm lesbian bondage .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\Temp\chinese bukkake masturbation feet blondie .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\brasilian action sperm catfight 40+ .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\swedish porn beast hot (!) balls .avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\african lesbian sleeping gorgeoushorny (Gina,Sarah).mpg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\swedish horse sperm public .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\african blowjob big leather .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\nude xxx uncut .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\fucking hot (!) (Curtney).mpeg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\lingerie several models feet .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\black cum xxx uncut mature .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\sperm sleeping .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\german lingerie big hole .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\tyrkish kicking lesbian masturbation (Karin).rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\danish cumshot trambling several models pregnant .avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\sperm voyeur feet .mpg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_7.2.7601.23317_none_2dca66b2e1eebfb5\malaysia fucking several models (Tatjana).avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\nude horse several models titts .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\asian bukkake several models (Sarah).rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\tyrkish kicking trambling girls cock bondage .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\horse lesbian hole penetration (Tatjana).mpeg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\cum gay catfight girly .avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\bukkake catfight .mpg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\trambling lesbian cock .avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\canadian hardcore [milf] .mpg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\british bukkake big .mpg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\brasilian beastiality beast sleeping .mpg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\swedish nude beast girls glans penetration (Sylvia).rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\gay voyeur .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\danish beastiality bukkake [bangbus] cock .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\tyrkish horse lesbian sleeping ¼ç .avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\cumshot blowjob catfight glans black hairunshaved .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\french beast hot (!) blondie .mpg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\british trambling hot (!) glans YEâPSè& (Karin).avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\InstallTemp\norwegian fucking hot (!) lady .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\danish cumshot lingerie catfight femdom .avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\russian cum gay uncut .avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\blowjob hot (!) boots .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\french lesbian hot (!) upskirt .avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\russian gang bang bukkake hot (!) hole .mpeg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\indian fetish lesbian masturbation cock fishy (Liz).avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\swedish action trambling sleeping .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\gay hidden young .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\swedish kicking horse big hole .avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\african bukkake hidden sweet .mpeg.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\british trambling lesbian (Sylvia).avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_7.2.7601.16406_none_2d4ae1adc8c9980e\american fetish lesbian hot (!) gorgeoushorny (Ashley,Tatjana).rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\action blowjob uncut bondage .zip.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\fucking full movie cock latex .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\british fucking licking feet (Sonja,Karin).avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\beastiality hardcore catfight .avi.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\Downloaded Program Files\lesbian big glans .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\indian kicking gay hot (!) hole black hairunshaved .rar.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exeae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exeae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exepid process 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe 1860 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exeae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exedescription pid process target process PID 1640 wrote to memory of 1908 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe PID 1640 wrote to memory of 1908 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe PID 1640 wrote to memory of 1908 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe PID 1640 wrote to memory of 1908 1640 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe PID 1908 wrote to memory of 1860 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe PID 1908 wrote to memory of 1860 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe PID 1908 wrote to memory of 1860 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe PID 1908 wrote to memory of 1860 1908 ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe"C:\Users\Admin\AppData\Local\Temp\ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe"C:\Users\Admin\AppData\Local\Temp\ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe"C:\Users\Admin\AppData\Local\Temp\ae86be669c3a8634ea266fa32bb31d17e129f6415ae28641f50624a69584c334.exe"3⤵
- Suspicious behavior: EnumeratesProcesses