42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d

General

Target

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
Size

342KB
MD5

2559340fb8d8f4e98ee58202d7f50fd0
SHA1

9c6efcc00e0283100987b57cc12a395eff4c03b7
SHA256

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d
SHA512

296d68a497086568aa6d436716006e2cf0e435e28c9eef3611dd7748f85a8b02e335e7432c3bc563e8190f6ab41a5511f79f37ebddcd8f610e63b654b81afb4e
SSDEEP

6144:zXC4vgmhbIxs3NBBt0CzlZ1JJskSO2acPJm8V64To0TnYh54Ja8jN4EjHmn:zXCNi9BD0slnsE2aOvsWe54RjNu

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

description	ioc	process
File opened (read-only)	\??\H:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\M:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\A:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\F:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\I:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\N:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\O:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\U:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\V:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\Z:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\B:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\E:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\J:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\K:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\P:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\Q:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\W:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\Y:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\G:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\L:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\R:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\S:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\T:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File opened (read-only)	\??\X:	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

Drops file in System32 directory 10 IoCs

Processes:

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\cumshot trambling [milf] girly .mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\american porn sperm licking femdom .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\System32\DriverStore\Temp\cum gay several models shoes .mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\SysWOW64\IME\shared\porn trambling sleeping feet mistress .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\spanish fetish [milf] nipples ejaculation .mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\SysWOW64\config\systemprofile\horse [milf] legs granny .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\SysWOW64\FxsTmp\chinese cum catfight ìï .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian handjob action voyeur vagina hotel .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\SysWOW64\FxsTmp\asian cumshot public wifey .rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\SysWOW64\IME\shared\brasilian handjob catfight legs .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

Drops file in Program Files directory 15 IoCs

Processes:

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

description	ioc	process
File created	C:\Program Files (x86)\Google\Update\Download\xxx sperm girls traffic .rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\handjob masturbation (Karin,Sonja).mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\indian sperm beastiality licking circumcision (Gina,Sandy).zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\italian cum fucking sleeping (Sylvia).mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files\DVD Maker\Shared\british blowjob licking cock .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files\Windows Journal\Templates\black bukkake several models .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\danish hardcore gay public femdom (Janette,Kathrin).avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\french horse masturbation titts .mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\nude cum sleeping (Liz).avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\chinese fucking girls vagina 40+ .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\chinese nude several models nipples .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Google\Temp\japanese sperm beastiality [free] .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\beast horse full movie nipples .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\african animal bukkake hot (!) vagina .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\bukkake horse [milf] ash .rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

Drops file in Windows directory 59 IoCs

Processes:

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

description	ioc	process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\tyrkish cumshot beastiality big vagina .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\italian bukkake lesbian .mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\malaysia beast uncut feet high heels .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\spanish beastiality kicking hot (!) bedroom .mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\xxx lesbian hidden .mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\danish porn bukkake catfight sm (Jade,Janette).avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\beast several models granny .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\japanese cumshot uncut .mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\blowjob voyeur .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\chinese animal masturbation titts 40+ .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\horse porn girls bondage .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\spanish lingerie lesbian .rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\canadian nude licking ash granny (Janette).zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\black lesbian bukkake masturbation upskirt .mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\french horse gay licking girly .mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\tmp\american action animal hot (!) traffic .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\PLA\Templates\spanish hardcore girls vagina gorgeoushorny (Jenna).avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\norwegian handjob blowjob hidden (Liz,Sylvia).avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\russian blowjob handjob uncut .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\brasilian sperm [milf] glans ejaculation .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\sperm big mistress .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\horse animal [bangbus] .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\security\templates\russian beastiality horse catfight .rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\canadian handjob handjob voyeur ìï .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\black beast xxx girls wifey .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\sperm xxx public .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\porn kicking [milf] vagina 40+ .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\beastiality big balls .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\asian horse full movie penetration .rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\french gang bang trambling masturbation hole girly (Sonja,Liz).zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\brasilian sperm animal sleeping hotel (Sarah).mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\danish fucking hidden .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\Downloaded Program Files\tyrkish hardcore [bangbus] .rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\malaysia horse fucking big .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\canadian beast big hotel (Sonja,Sarah).rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\brasilian lesbian beast sleeping boobs beautyfull (Sylvia,Britney).mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\handjob [free] .mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\horse animal [bangbus] ash femdom .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\temp\kicking blowjob hot (!) mature .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\malaysia horse licking mistress .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\brasilian gang bang bukkake several models boots (Sarah,Christine).rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\brasilian horse cum catfight .rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\russian hardcore animal [milf] high heels .mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\swedish fetish kicking sleeping traffic .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\SoftwareDistribution\Download\canadian beastiality bukkake hot (!) bondage .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\norwegian fucking licking (Anniston).mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\spanish animal uncut .mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\russian trambling voyeur 40+ .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\gay voyeur lady .rar.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\cumshot horse [milf] hole femdom .mpeg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\tyrkish fucking full movie .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\american nude full movie (Curtney,Britney).mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\fetish catfight boobs .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\chinese lingerie hot (!) wifey .avi.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\action girls cock femdom .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\mssrv.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\hardcore [free] granny .mpg.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\asian horse lesbian sleeping feet .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\italian animal several models stockings .zip.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

pid	process
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
1508	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

description	pid	process	target process
PID 848 wrote to memory of 1256	848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 848 wrote to memory of 1256	848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 848 wrote to memory of 1256	848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 848 wrote to memory of 1256	848	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 1256 wrote to memory of 1508	1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 1256 wrote to memory of 1508	1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 1256 wrote to memory of 1508	1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
PID 1256 wrote to memory of 1508	1256	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe	42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe

C:\Users\Admin\AppData\Local\Temp\42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
"C:\Users\Admin\AppData\Local\Temp\42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:848

C:\Users\Admin\AppData\Local\Temp\42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
"C:\Users\Admin\AppData\Local\Temp\42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1256

C:\Users\Admin\AppData\Local\Temp\42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe
"C:\Users\Admin\AppData\Local\Temp\42770041b01cfd8396d07c4e2ebedd9a251459fc19c983d31ba849a45ebdfe2d.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-54-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/1256-55-0x0000000000000000-mapping.dmp

Download
memory/1508-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads