Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 18:24
Behavioral task
behavioral1
Sample
32d252534c542367c9142722d7846e30.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
32d252534c542367c9142722d7846e30.exe
Resource
win10v2004-20231215-en
General
-
Target
32d252534c542367c9142722d7846e30.exe
-
Size
1.9MB
-
MD5
32d252534c542367c9142722d7846e30
-
SHA1
3f12815829d49c4a3c58a4c81d1b29a6bbe0559f
-
SHA256
af76eca8fb87654239cf27832deaf940bdc25aba67aab489272909d3f92950f4
-
SHA512
0f42263bce1904972225799c0ecb121dade8b93b170960e95bd11602cf5d21dfd2989c9d2f898f940e5803417c8ace5992a295c6a946be0a1edda1a2a903b15d
-
SSDEEP
49152:DNVHofUQUKnHVotxmM6/d7KwoZgJDtaGmeSdjkrfR:DNVHTKHWt8JoZgJDt3Aq
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2976-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0008000000014fc0-5.dat upx behavioral1/memory/2772-46-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2428-67-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2976-95-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2772-98-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2428-100-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 32d252534c542367c9142722d7846e30.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\K: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\O: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\T: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\W: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\X: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\E: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\G: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\J: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\M: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\Q: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\A: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\N: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\P: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\R: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\S: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\V: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\Y: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\B: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\I: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\L: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\U: 32d252534c542367c9142722d7846e30.exe File opened (read-only) \??\Z: 32d252534c542367c9142722d7846e30.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\FxsTmp\japanese beast lesbian upskirt .mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\bukkake catfight shoes .rar.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\SysWOW64\config\systemprofile\african bukkake beast voyeur redhair .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\kicking catfight hole bedroom (Karin).rar.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\System32\DriverStore\Temp\action trambling girls pregnant .mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\sperm cumshot catfight .avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\SysWOW64\IME\shared\malaysia animal several models .zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\SysWOW64\FxsTmp\japanese xxx nude full movie .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\SysWOW64\IME\shared\brasilian cumshot beast catfight (Sarah,Sylvia).rar.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\SysWOW64\config\systemprofile\beastiality lesbian lesbian ash wifey (Britney).rar.exe 32d252534c542367c9142722d7846e30.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\microsoft shared\nude hardcore girls .avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Program Files (x86)\Google\Temp\fucking beastiality several models .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Program Files (x86)\Microsoft Office\Templates\chinese handjob fucking several models hotel .mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\gay masturbation vagina bedroom .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Program Files\Common Files\Microsoft Shared\malaysia fetish handjob [milf] ash upskirt .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Program Files\Windows Journal\Templates\trambling porn [milf] .avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\beast xxx voyeur high heels .rar.exe 32d252534c542367c9142722d7846e30.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\gang bang sleeping hairy .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Program Files (x86)\Google\Update\Download\fucking lesbian hot (!) feet castration .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\gay [milf] ash .zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\german porn licking bedroom .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Program Files\DVD Maker\Shared\action hot (!) granny .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\russian kicking trambling big titts .mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\russian sperm big ¤ã (Karin).rar.exe 32d252534c542367c9142722d7846e30.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\horse horse several models .avi.exe 32d252534c542367c9142722d7846e30.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\fetish voyeur granny .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\hardcore licking (Melissa,Melissa).mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\trambling horse licking titts shoes (Anniston).mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\spanish gay sperm licking nipples mistress .avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\italian nude animal girls glans young (Kathrin).mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\chinese sperm hidden gorgeoushorny .zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\danish kicking fucking hot (!) pregnant .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\chinese fetish porn [bangbus] balls (Jenna,Christine).avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\swedish kicking handjob [free] pregnant (Gina,Britney).zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\porn beast [free] .avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\security\templates\japanese hardcore porn uncut YEâPSè& (Samantha).rar.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\animal several models 50+ .avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\russian fetish hot (!) high heels .mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\french nude masturbation pregnant (Liz).avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\InstallTemp\lesbian sperm voyeur ash ìï .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\asian fetish lingerie several models ash fishy .mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\japanese fucking sperm big (Sarah,Tatjana).zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\porn cum girls .zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\tyrkish action cum big .mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\fucking action girls .mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\british hardcore big glans .avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\african bukkake sleeping ash bedroom .mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\spanish horse nude girls vagina .avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\animal lingerie catfight blondie .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\british lesbian xxx several models ash (Janette).zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\japanese hardcore girls .zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\spanish fetish trambling [free] castration (Melissa).zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\swedish trambling licking boobs .zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\danish horse sleeping .zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\blowjob [free] (Sylvia).mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\german trambling licking balls .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\horse lingerie full movie penetration (Jade,Tatjana).mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\malaysia cumshot animal hot (!) ash traffic .zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\tyrkish gang bang [free] .zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\gang bang uncut penetration .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\Downloaded Program Files\gang bang xxx full movie boobs beautyfull (Britney).mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\handjob [bangbus] shoes .zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\german gay public lady .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\brasilian horse several models vagina balls .avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\canadian beast [free] .mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\Temp\fetish action licking legs swallow .rar.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\brasilian gay handjob voyeur (Curtney,Sonja).mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\danish nude [milf] vagina .avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\black hardcore public gorgeoushorny .mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\beastiality action catfight bedroom .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\french lingerie beast full movie upskirt (Liz,Sonja).avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\american kicking xxx public boobs 50+ .zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\german cumshot [free] YEâPSè& (Sonja).zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\kicking action [bangbus] traffic .rar.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\asian fetish public .mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\italian lesbian licking (Liz).zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\canadian handjob hardcore full movie hole gorgeoushorny .mpg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\asian lingerie girls fishy .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\horse bukkake [milf] .rar.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\kicking voyeur (Kathrin).rar.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\french cum uncut shoes .zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\spanish beastiality public feet .avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\german blowjob several models .avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\handjob lingerie public redhair .avi.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\hardcore [bangbus] .rar.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\black porn beast hot (!) balls .zip.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\assembly\tmp\bukkake kicking catfight black hairunshaved .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\danish lesbian several models .mpeg.exe 32d252534c542367c9142722d7846e30.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\chinese beast [free] (Tatjana).mpg.exe 32d252534c542367c9142722d7846e30.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe 2428 32d252534c542367c9142722d7846e30.exe 2772 32d252534c542367c9142722d7846e30.exe 2976 32d252534c542367c9142722d7846e30.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2772 2976 32d252534c542367c9142722d7846e30.exe 28 PID 2976 wrote to memory of 2772 2976 32d252534c542367c9142722d7846e30.exe 28 PID 2976 wrote to memory of 2772 2976 32d252534c542367c9142722d7846e30.exe 28 PID 2976 wrote to memory of 2772 2976 32d252534c542367c9142722d7846e30.exe 28 PID 2772 wrote to memory of 2428 2772 32d252534c542367c9142722d7846e30.exe 29 PID 2772 wrote to memory of 2428 2772 32d252534c542367c9142722d7846e30.exe 29 PID 2772 wrote to memory of 2428 2772 32d252534c542367c9142722d7846e30.exe 29 PID 2772 wrote to memory of 2428 2772 32d252534c542367c9142722d7846e30.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\32d252534c542367c9142722d7846e30.exe"C:\Users\Admin\AppData\Local\Temp\32d252534c542367c9142722d7846e30.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\32d252534c542367c9142722d7846e30.exe"C:\Users\Admin\AppData\Local\Temp\32d252534c542367c9142722d7846e30.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\32d252534c542367c9142722d7846e30.exe"C:\Users\Admin\AppData\Local\Temp\32d252534c542367c9142722d7846e30.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2428
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5f65e92395a8c6a4915e6d4a2df5c43dd
SHA1ac6b0cea8ba076a35c8efc35b4f0886e7b5a7d82
SHA256d770eb4afae874c5e33658afc42729f5df2f809cf674033db077b22381a278c6
SHA5121753f43169f32f0baeec67df7127e6cd4d1c850112831fc71608663ce522857fdaa2c4a4187a1e13ae8f9770ebadaf2bcb482e61d5d08adbee61e41f630d8ddd
-
Filesize
183B
MD5f7b1b7992e0c36ea7499e03ddc6153ad
SHA14ac1f699f86f2a9f106e750cbf183be70c4370a3
SHA256c2af58e0c90bd714ee10848df0ed6ac88178fb30e02cd6235618823feca8c9b9
SHA5123ae5ccf80ee36e354e477c1d2a8b50afd76b44e4a2fa7ffc3125241f0f30f46374d7dd27a13ca0516628de650939f81fac32c41cbec386d1d9535531f7362cab