Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 18:56
Behavioral task
behavioral1
Sample
3a5027348187535ea6e51bbe3e6762d2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3a5027348187535ea6e51bbe3e6762d2.exe
Resource
win10v2004-20231215-en
General
-
Target
3a5027348187535ea6e51bbe3e6762d2.exe
-
Size
2.0MB
-
MD5
3a5027348187535ea6e51bbe3e6762d2
-
SHA1
9c4c62d970110a71881e4a4e24c621032bb81075
-
SHA256
4a273105d0d2f071ff747b87d7890cd255ca366025bec4bda0b68bc7e3283314
-
SHA512
7c0456e72335359b667ec691fdee22b8b54b8b1d0b658dd5a40db10fe81b447f0509bfdf4fbfd5e9ddb9ef0bd3314dc7be05a48bb068883cd30f15f1fc29ddc4
-
SSDEEP
49152:QyLIQso24XPTUHCBF6dDLmJjnA8YZ9KpecU29IbCZeX:XLI5o2QUhaJsPQecbgxX
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1684-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2652-5-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0007000000015584-7.dat upx behavioral1/memory/2720-12-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2672-14-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1684-74-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2652-78-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2720-79-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2672-82-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 3a5027348187535ea6e51bbe3e6762d2.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\B: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\H: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\P: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\S: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\T: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\Y: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\Z: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\J: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\N: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\O: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\U: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\W: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\X: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\L: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\M: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\Q: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\R: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\V: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\E: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\G: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\I: 3a5027348187535ea6e51bbe3e6762d2.exe File opened (read-only) \??\K: 3a5027348187535ea6e51bbe3e6762d2.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\System32\LogFiles\Fax\Incoming\trambling hidden lady .mpg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\SysWOW64\config\systemprofile\lesbian horse hidden pregnant .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\german action [milf] .avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian beastiality handjob several models .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\System32\DriverStore\Temp\chinese fetish lingerie hot (!) (Melissa).avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\SysWOW64\IME\shared\american lingerie lesbian hole .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\SysWOW64\FxsTmp\handjob uncut ash .avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\SysWOW64\IME\shared\canadian hardcore horse lesbian legs .avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\SysWOW64\config\systemprofile\beast horse lesbian vagina .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\SysWOW64\FxsTmp\gang bang trambling big .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\italian cumshot full movie glans (Tatjana,Sonja).avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\trambling bukkake [bangbus] 50+ (Liz).rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Program Files (x86)\Microsoft Office\Templates\norwegian lingerie gang bang full movie glans circumcision .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Program Files\DVD Maker\Shared\french trambling lingerie [milf] wifey (Liz,Tatjana).mpg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Program Files\Windows Journal\Templates\beastiality hidden boobs .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\japanese bukkake lesbian stockings (Melissa,Melissa).zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\malaysia gay gang bang girls (Tatjana).zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\african cumshot action public .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Program Files (x86)\Google\Temp\bukkake masturbation feet lady .mpg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Program Files (x86)\Google\Update\Download\beast kicking hot (!) cock lady .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\blowjob voyeur shoes .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\bukkake kicking uncut beautyfull .avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Program Files\Common Files\Microsoft Shared\beastiality beastiality big (Liz).rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\french action lesbian 40+ .mpg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Program Files (x86)\Common Files\microsoft shared\british porn masturbation nipples .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\cum beastiality public .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\bukkake sleeping lady .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\cumshot full movie .rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\japanese fucking animal uncut vagina pregnant .avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\hardcore catfight .avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\american handjob nude several models 50+ .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\british horse beastiality masturbation .rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\handjob sperm several models 50+ .rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\japanese fetish masturbation legs (Kathrin).avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\gay lingerie catfight shower (Kathrin).mpg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\PLA\Templates\japanese fucking xxx public girly .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\black lesbian [bangbus] hotel .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\canadian handjob cumshot sleeping stockings .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\black beastiality blowjob voyeur vagina circumcision (Jade).avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\malaysia sperm lingerie hidden shoes .rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\kicking hot (!) boobs (Samantha,Curtney).mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\horse gay sleeping bondage .rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\malaysia lingerie porn hot (!) .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\chinese beastiality uncut leather .rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\british action [bangbus] 40+ .avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\handjob beast [milf] wifey .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\brasilian hardcore animal licking bondage (Jenna).zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\horse lesbian licking hotel .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\lesbian masturbation 40+ (Sonja).avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\malaysia bukkake porn hot (!) ash ìï .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\african gay animal [free] balls .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\black xxx porn voyeur vagina swallow .mpg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\asian nude cumshot licking .avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\InstallTemp\lesbian kicking girls circumcision (Anniston,Janette).rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\lingerie [free] .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\beastiality xxx public feet girly .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\brasilian gang bang cumshot girls penetration .rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\chinese fetish catfight glans .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\hardcore sleeping boots .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\tyrkish sperm beast masturbation .mpg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\SoftwareDistribution\Download\fetish catfight leather .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\tyrkish lingerie hidden lady .avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\japanese nude gay full movie hole girly .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\indian xxx porn [milf] castration (Sarah,Melissa).rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\american horse xxx lesbian ash latex .rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\italian hardcore lesbian big ash .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\norwegian horse horse lesbian nipples .mpg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\danish nude full movie lady .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\black animal [milf] femdom (Karin).avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\kicking voyeur lady (Karin,Tatjana).mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\swedish lingerie hidden hole bedroom .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\danish nude hardcore uncut .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\fucking full movie redhair (Jade).mpg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\indian gang bang trambling full movie .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\security\templates\gay full movie feet (Christine).rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\kicking uncut titts femdom .zip.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\spanish fetish uncut (Sylvia).rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\asian cumshot trambling hidden .rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\malaysia kicking lesbian licking sm .mpg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\asian porn lesbian full movie nipples .mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\bukkake horse [milf] (Jade).avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\asian horse masturbation (Gina,Tatjana).mpg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\chinese lesbian beastiality uncut .mpg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\nude [free] bondage .rar.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\Temp\bukkake nude full movie .avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\sperm lingerie hidden vagina shoes .mpg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\british cumshot licking .mpg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\black lingerie horse lesbian young (Tatjana).mpeg.exe 3a5027348187535ea6e51bbe3e6762d2.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\danish lesbian full movie ejaculation .avi.exe 3a5027348187535ea6e51bbe3e6762d2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe 2720 3a5027348187535ea6e51bbe3e6762d2.exe 2652 3a5027348187535ea6e51bbe3e6762d2.exe 1684 3a5027348187535ea6e51bbe3e6762d2.exe 2672 3a5027348187535ea6e51bbe3e6762d2.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2652 1684 3a5027348187535ea6e51bbe3e6762d2.exe 28 PID 1684 wrote to memory of 2652 1684 3a5027348187535ea6e51bbe3e6762d2.exe 28 PID 1684 wrote to memory of 2652 1684 3a5027348187535ea6e51bbe3e6762d2.exe 28 PID 1684 wrote to memory of 2652 1684 3a5027348187535ea6e51bbe3e6762d2.exe 28 PID 2652 wrote to memory of 2720 2652 3a5027348187535ea6e51bbe3e6762d2.exe 29 PID 2652 wrote to memory of 2720 2652 3a5027348187535ea6e51bbe3e6762d2.exe 29 PID 2652 wrote to memory of 2720 2652 3a5027348187535ea6e51bbe3e6762d2.exe 29 PID 2652 wrote to memory of 2720 2652 3a5027348187535ea6e51bbe3e6762d2.exe 29 PID 1684 wrote to memory of 2672 1684 3a5027348187535ea6e51bbe3e6762d2.exe 30 PID 1684 wrote to memory of 2672 1684 3a5027348187535ea6e51bbe3e6762d2.exe 30 PID 1684 wrote to memory of 2672 1684 3a5027348187535ea6e51bbe3e6762d2.exe 30 PID 1684 wrote to memory of 2672 1684 3a5027348187535ea6e51bbe3e6762d2.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe"C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe"C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe"C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2720
-
-
-
C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe"C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
976KB
MD571b7e0c35e8f4afb89835fbf2782074d
SHA167889d4106dce98df824d06fbd2edb8125d2f22b
SHA2566fb62e6868b5f649c9ea8a360b359010e6181d2569c5b14c278307d5ba59b912
SHA512ecaf831cb28d453ade40ca13878081f49973bb2ec4f14f23328b07f02dcbae963a39b790f40e1bbc3d28fdfaab8fd3d4af9ff153b8e3a5c9f52c7ae6620f50f5