Analysis
-
max time kernel
165s -
max time network
176s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-10-2022 21:01
Static task
static1
Behavioral task
behavioral1
Sample
43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe
-
Size
1.5MB
-
MD5
91918fda0133e1608dff8c03c2821280
-
SHA1
6ab2a29c7b108476bb534d3426bca8332b385428
-
SHA256
43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2
-
SHA512
828d0f73fe5c8f61c16c4c0f471a57c24198c8552b221bc9d1e9d3f502bdc840a15ee358023a632e55d47986437fd83ebc2be5fadd136faa746f37c4e3be7824
-
SSDEEP
24576:2WhImrf1tWxLpe3xvUEyGXCUdkbYvGl1J84snQonsB0ys4GpdpMbMu:zhI29sLpe36QXN6GGlLnqKJeu
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\H: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\J: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\O: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\W: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\Y: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\M: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\Q: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\R: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\S: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\T: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\V: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\A: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\B: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\I: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\L: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\U: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\X: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\Z: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\F: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\G: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\K: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\N: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File opened (read-only) \??\P: 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\horse sleeping .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\SysWOW64\IME\shared\russian action horse [bangbus] .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\SysWOW64\IME\shared\swedish action xxx uncut titts 50+ .zip.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\SysWOW64\config\systemprofile\fucking [bangbus] .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\System32\DriverStore\Temp\lesbian voyeur glans femdom .avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\SysWOW64\FxsTmp\canadian sperm [bangbus] glans .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\tyrkish action trambling big cock traffic .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\SysWOW64\FxsTmp\black cum hardcore licking hole blondie (Sylvia).mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\SysWOW64\config\systemprofile\lesbian lesbian titts sweet .avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian cum trambling girls feet hairy .avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\indian kicking trambling hot (!) feet stockings .avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\indian fetish sperm [milf] mature .zip.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\tyrkish action horse [milf] glans .rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\swedish cumshot trambling catfight hole ash .rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Program Files\DVD Maker\Shared\horse girls feet boots .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Program Files\Windows Journal\Templates\trambling hot (!) (Sarah).mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Program Files (x86)\Google\Update\Download\danish nude hardcore several models .mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\beast full movie sm .avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\danish cum lesbian [free] (Curtney).mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Program Files\Common Files\Microsoft Shared\indian porn xxx lesbian circumcision .mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Program Files (x86)\Google\Temp\japanese horse hardcore lesbian glans femdom (Samantha).avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Program Files (x86)\Microsoft Office\Templates\brasilian cum hardcore [milf] glans (Christine,Samantha).avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\tyrkish handjob horse lesbian high heels .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\lingerie full movie penetration .mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Program Files (x86)\Common Files\microsoft shared\black horse xxx hot (!) .zip.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\cumshot lesbian big cock young (Sylvia).rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\norwegian lesbian girls granny (Anniston,Karin).mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\brasilian beastiality xxx hot (!) sweet .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\norwegian blowjob full movie cock hotel .rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\gang bang hardcore full movie glans ejaculation (Sarah).mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\african blowjob lesbian lady .rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\fucking licking boots .mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\lingerie uncut .zip.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\chinese xxx [bangbus] cock .rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\chinese horse catfight feet .avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\swedish kicking sperm sleeping (Jade).mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\blowjob catfight sweet .zip.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\gay [milf] cock femdom (Karin).avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\beastiality trambling [free] (Sarah).rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\british xxx licking femdom .rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\sperm masturbation glans circumcision .avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\german fucking [milf] hole (Sonja,Melissa).zip.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\gang bang trambling masturbation 40+ .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\asian blowjob [free] feet .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\sperm [bangbus] feet 40+ (Janette).mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\russian handjob fucking [free] .rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\african lingerie several models hairy .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\lingerie sleeping ìï (Sonja,Janette).rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\tyrkish fetish fucking [milf] ¼ç .rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\italian horse hardcore big (Sarah).rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\beast uncut cock castration (Melissa).mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\horse gay full movie (Karin).mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\japanese handjob lingerie hot (!) .rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\lingerie lesbian ìï .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\african blowjob [free] shower .zip.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\brasilian nude lingerie masturbation cock (Anniston,Janette).avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\spanish lingerie lesbian pregnant .mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\animal lesbian big .avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\cumshot horse licking glans latex (Sarah).zip.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\japanese horse beast hidden titts gorgeoushorny .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\assembly\temp\indian handjob horse masturbation mistress .rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\tyrkish cumshot fucking big .mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\norwegian horse voyeur gorgeoushorny .mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\lingerie hot (!) high heels .zip.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\nude blowjob lesbian .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\porn sperm [bangbus] cock boots (Sylvia).mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\animal horse full movie cock mistress (Sarah).mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\danish kicking xxx hidden (Liz).mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\brasilian gang bang lesbian several models feet wifey (Sylvia).mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\black animal beast girls (Sarah).mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\british lingerie voyeur feet lady (Janette).mpg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\canadian lesbian hidden traffic .rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\indian action beast hot (!) titts .zip.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\InstallTemp\british fucking hot (!) stockings .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\porn fucking public .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\spanish trambling hidden shoes .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\tyrkish horse gay hot (!) glans penetration .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\bukkake masturbation .avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\cum xxx voyeur ejaculation .zip.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\spanish gay lesbian blondie .avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\danish handjob fucking hot (!) (Jade).rar.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\spanish bukkake masturbation .avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\security\templates\trambling big castration (Sonja,Melissa).zip.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\horse girls cock granny .avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\xxx sleeping hole bedroom .mpeg.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\danish handjob horse sleeping .zip.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\canadian sperm hot (!) high heels .avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\canadian fucking catfight hole mistress .avi.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe File created C:\Windows\mssrv.exe 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 2020 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1100 wrote to memory of 2024 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 27 PID 1100 wrote to memory of 2024 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 27 PID 1100 wrote to memory of 2024 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 27 PID 1100 wrote to memory of 2024 1100 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 27 PID 2024 wrote to memory of 2020 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 28 PID 2024 wrote to memory of 2020 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 28 PID 2024 wrote to memory of 2020 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 28 PID 2024 wrote to memory of 2020 2024 43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe"C:\Users\Admin\AppData\Local\Temp\43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe"C:\Users\Admin\AppData\Local\Temp\43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe"C:\Users\Admin\AppData\Local\Temp\43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2020
-
-