Analysis
-
max time kernel
115s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08/01/2024, 20:30
Behavioral task
behavioral1
Sample
a4bac2e362f95cf68856aaa1a3abb488.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4bac2e362f95cf68856aaa1a3abb488.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
a4bac2e362f95cf68856aaa1a3abb488.exe
-
Size
113KB
-
MD5
a4bac2e362f95cf68856aaa1a3abb488
-
SHA1
c4c768cab5225887aa0f6a39f059cfc66f7dc505
-
SHA256
80df5b46588be40b928b6f0ec9aec01cea118ff31e78d119600451324d759eb9
-
SHA512
183e1f58725cee0d608be7b713b9a27dfefff4da0810f0c89f558ae40a1a141083010777c29291bdce45aee6cd1c437c2b7c971db37af23850aaa1863813ee15
-
SSDEEP
3072:aDOkexJLFdrPZ1Tj4mYWR/R4nkPR/1aVuyJMO7Oih7vC:aDOxZXPIo5R4nM/40yJMO7vh7a
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/880-0-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/files/0x000a000000015f71-5.dat upx behavioral1/memory/2960-90-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1900-92-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/880-104-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/880-107-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/880-111-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/880-114-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/880-117-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/880-122-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/880-125-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/880-128-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/880-131-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/880-134-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/880-137-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/880-140-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/880-143-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" a4bac2e362f95cf68856aaa1a3abb488.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\A: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\E: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\I: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\M: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\T: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\X: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\W: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\B: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\G: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\J: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\O: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\R: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\S: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\H: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\K: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\N: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\V: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\Z: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\L: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\P: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\Q: a4bac2e362f95cf68856aaa1a3abb488.exe File opened (read-only) \??\U: a4bac2e362f95cf68856aaa1a3abb488.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\FxsTmp\spanish fucking [bangbus] hole .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\SysWOW64\IME\shared\blowjob [milf] (Karin).avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\SysWOW64\config\systemprofile\american kicking blowjob masturbation hole lady (Tatjana).zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\xxx several models glans leather (Janette).mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\SysWOW64\FxsTmp\danish action blowjob hidden hole .mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\SysWOW64\IME\shared\swedish gang bang blowjob catfight .avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\SysWOW64\config\systemprofile\hardcore uncut .zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\gay [milf] cock .avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\System32\DriverStore\Temp\fucking hidden feet traffic .avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\italian nude xxx hot (!) sweet (Sonja,Sylvia).mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Windows Journal\Templates\black gang bang sperm lesbian fishy .rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\japanese cum gay catfight boots .mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Program Files (x86)\Microsoft Office\Templates\russian fetish hardcore hot (!) boots (Sonja,Sylvia).zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\russian fetish hardcore girls titts .rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\xxx uncut .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Program Files (x86)\Google\Temp\lesbian girls cock .rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Program Files\DVD Maker\Shared\trambling full movie glans swallow .mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Program Files (x86)\Common Files\microsoft shared\swedish fetish horse catfight balls .mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\american cumshot blowjob [bangbus] hole boots .zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fucking voyeur (Jade).rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Program Files\Common Files\Microsoft Shared\indian gang bang trambling hot (!) hairy .zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\brasilian action blowjob girls cock .zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\swedish porn gay [milf] .avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Program Files (x86)\Google\Update\Download\blowjob public 50+ (Kathrin,Karin).mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\fucking several models hole (Christine,Samantha).avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\sperm hot (!) girly .zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\lesbian masturbation hole mature .rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\norwegian fucking catfight cock mature (Karin).avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\russian handjob lingerie several models (Tatjana).avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\security\templates\lingerie masturbation titts .avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\sperm licking feet .rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\german lesbian [free] titts mature .avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\black animal bukkake lesbian .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\asian blowjob hot (!) (Sylvia).mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\french fucking [bangbus] .mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\brasilian fetish gay [bangbus] cock .mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\malaysia lesbian masturbation ash .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\cum horse sleeping stockings (Kathrin,Sylvia).mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\sperm big titts .zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\malaysia hardcore lesbian titts .zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\russian nude lingerie big hole mature (Jade).mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\spanish xxx uncut hotel .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\indian beastiality horse lesbian gorgeoushorny .avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\horse hidden titts 50+ (Melissa).mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\african beast [free] .avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\bukkake [milf] feet circumcision .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\tyrkish beastiality lesbian [bangbus] feet .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\american kicking beast girls hairy .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\tyrkish nude gay [bangbus] lady (Jenna,Liz).rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\gang bang blowjob girls hotel .avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\asian lingerie [bangbus] feet bedroom .avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\bukkake lesbian (Tatjana).rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\russian fetish blowjob catfight glans beautyfull .zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\bukkake voyeur .rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\american fetish sperm masturbation 50+ .rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\trambling catfight penetration .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\french lesbian hidden fishy .mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\action fucking masturbation ìï (Christine,Jade).zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\french horse hot (!) feet .mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\black handjob gay masturbation (Karin).zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\handjob blowjob catfight hole black hairunshaved (Jade).avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\swedish fetish gay [free] .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\blowjob big shower .rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\italian cumshot hardcore sleeping cock sm (Sarah).mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\french xxx public .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\malaysia xxx sleeping bedroom .zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\animal xxx public .mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\lingerie licking pregnant .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\Downloaded Program Files\horse hot (!) cock high heels .rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\sperm hot (!) ejaculation .zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\porn hardcore [milf] wifey .mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\assembly\temp\american nude xxx several models penetration .mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\brasilian kicking hardcore catfight cock mistress .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\cum horse [milf] shoes (Britney,Liz).avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\Temp\blowjob sleeping glans upskirt .zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\handjob fucking several models .avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\brasilian beastiality blowjob catfight young .mpeg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\spanish trambling [free] cock .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\french trambling full movie hole girly .zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\african trambling lesbian feet redhair .rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\fucking [milf] shoes (Anniston,Curtney).avi.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\danish beastiality blowjob full movie circumcision .rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\fucking catfight .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\canadian horse big upskirt (Anniston,Curtney).mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\PLA\Templates\italian cumshot fucking [bangbus] bondage .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\sperm public glans .rar.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\SoftwareDistribution\Download\tyrkish fetish beast full movie hole (Kathrin,Sylvia).zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\indian cumshot horse hot (!) feet redhair .zip.exe a4bac2e362f95cf68856aaa1a3abb488.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\american horse horse [milf] ìï .mpg.exe a4bac2e362f95cf68856aaa1a3abb488.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe 880 a4bac2e362f95cf68856aaa1a3abb488.exe 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 1900 a4bac2e362f95cf68856aaa1a3abb488.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 880 wrote to memory of 2960 880 a4bac2e362f95cf68856aaa1a3abb488.exe 28 PID 880 wrote to memory of 2960 880 a4bac2e362f95cf68856aaa1a3abb488.exe 28 PID 880 wrote to memory of 2960 880 a4bac2e362f95cf68856aaa1a3abb488.exe 28 PID 880 wrote to memory of 2960 880 a4bac2e362f95cf68856aaa1a3abb488.exe 28 PID 2960 wrote to memory of 1900 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 29 PID 2960 wrote to memory of 1900 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 29 PID 2960 wrote to memory of 1900 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 29 PID 2960 wrote to memory of 1900 2960 a4bac2e362f95cf68856aaa1a3abb488.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4bac2e362f95cf68856aaa1a3abb488.exe"C:\Users\Admin\AppData\Local\Temp\a4bac2e362f95cf68856aaa1a3abb488.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\a4bac2e362f95cf68856aaa1a3abb488.exe"C:\Users\Admin\AppData\Local\Temp\a4bac2e362f95cf68856aaa1a3abb488.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\a4bac2e362f95cf68856aaa1a3abb488.exe"C:\Users\Admin\AppData\Local\Temp\a4bac2e362f95cf68856aaa1a3abb488.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1900
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244KB
MD53ac91f7c304e34e0590543e14283e161
SHA185e7d03ba28a9f760284e0f56c4cc07dc2c93572
SHA25694b5beb32b52290e888f468ca50a11a4c154ca2bc71f1b93e10134003c21e930
SHA512102bdefea5b875fc56f60f28f83d030a6f13fe6a7997ebf7edd48fa32bb71cf23aa23c40fdc8a6a601b8d6a1f0086c78bdb0da1f2123981ce7eb95867de81ea9