Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
98s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 18:28
Behavioral task
behavioral1
Sample
61e002d8767d858e405ea95445ddf1b1.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
61e002d8767d858e405ea95445ddf1b1.exe
Resource
win10v2004-20231215-en
General
-
Target
61e002d8767d858e405ea95445ddf1b1.exe
-
Size
344KB
-
MD5
61e002d8767d858e405ea95445ddf1b1
-
SHA1
0b933664bb71bf38635f26fd5103c8f18cb4ae9c
-
SHA256
296e548c6b55ab8cebe934b592ae9204ecfe2ef21a1b44b13663526153c6a559
-
SHA512
e125126d73a969a95837bc3bdd42e20135cc79293e80475f59dcd807dee933fe3f4756999b77bca064608cf500d3672cb2f6313a8e0a6cf40a432c036a5d80ed
-
SSDEEP
6144:7jluQoSWIo5R4nM/40yJNI9wxcmhkZJEeM17FVUhXyv31wIqB2IlE0ashEC0OjYa:7EQoSaqhYwxiAeMt7UEv318wGEKL
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2964-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2824-66-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1136-90-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2824-89-0x0000000001F10000-0x0000000001F2F000-memory.dmp upx behavioral1/memory/2964-106-0x00000000062E0000-0x00000000062FF000-memory.dmp upx behavioral1/memory/2964-105-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2824-109-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 61e002d8767d858e405ea95445ddf1b1.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\L: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\Q: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\R: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\P: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\S: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\T: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\U: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\W: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\B: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\K: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\N: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\Y: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\Z: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\I: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\O: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\V: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\H: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\J: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\M: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\A: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\E: 61e002d8767d858e405ea95445ddf1b1.exe File opened (read-only) \??\G: 61e002d8767d858e405ea95445ddf1b1.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\FxsTmp\cum trambling big fishy (Christine,Jade).avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\SysWOW64\IME\shared\italian kicking lesbian [milf] latex .rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\russian cum trambling licking blondie .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\japanese kicking lingerie girls hole .zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\SysWOW64\config\systemprofile\swedish beastiality gay masturbation .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\american handjob sperm public granny (Anniston,Liz).zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\System32\DriverStore\Temp\horse big .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\SysWOW64\config\systemprofile\horse public bondage .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\SysWOW64\FxsTmp\tyrkish kicking fucking hidden hole .rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\SysWOW64\IME\shared\lingerie public cock .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Windows Journal\Templates\hardcore [milf] hole (Gina,Samantha).mpg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\american beastiality gay [bangbus] titts castration (Karin).zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\italian cum beast full movie cock .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Program Files\DVD Maker\Shared\lingerie licking balls .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\indian porn beast sleeping 40+ .zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Program Files (x86)\Google\Temp\lesbian catfight cock fishy (Melissa).rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Program Files (x86)\Microsoft Office\Templates\blowjob hidden .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\swedish gang bang gay sleeping swallow .mpg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fucking licking latex .zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\italian action xxx sleeping sweet (Ashley,Sylvia).rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\beast public (Tatjana).rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Program Files\Common Files\Microsoft Shared\trambling hidden (Karin).rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\japanese cum bukkake [bangbus] boots .zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Program Files (x86)\Google\Update\Download\tyrkish horse hardcore lesbian glans shoes (Tatjana).mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\brasilian animal beast masturbation (Melissa).mpg.exe 61e002d8767d858e405ea95445ddf1b1.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\brasilian action trambling hidden castration .rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\american beastiality beast masturbation .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\tyrkish beastiality lingerie uncut 50+ .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\mssrv.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\trambling lesbian feet fishy .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\blowjob [milf] sweet .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\italian kicking gay [bangbus] high heels .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\german lingerie licking glans .mpg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\black handjob fucking big boots .mpg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\asian blowjob licking hole hotel .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\danish gang bang horse [milf] pregnant .mpg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\french lingerie licking mistress .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\tyrkish cumshot horse several models glans .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\norwegian sperm big lady .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\assembly\temp\tyrkish animal gay girls feet .mpg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\asian lingerie big ìï .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\tyrkish nude horse public titts ash .mpg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\black horse horse several models glans YEâPSè& .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\spanish blowjob hidden cock (Sonja,Samantha).mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\swedish handjob xxx [free] blondie .zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\italian kicking beast uncut cock high heels (Samantha).mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\InstallTemp\gay catfight titts hotel (Tatjana).rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\kicking trambling catfight feet hairy .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\porn beast uncut glans .rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\animal hardcore masturbation .mpg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\american porn gay public titts ejaculation .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\assembly\tmp\lingerie uncut .mpg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\asian beast full movie cock .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\lesbian catfight glans penetration .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\cumshot horse [milf] .zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\brasilian action fucking hidden black hairunshaved (Christine,Karin).avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\american cumshot hardcore lesbian hole penetration (Sarah).mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\swedish horse lesbian [free] cock leather (Curtney).rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\security\templates\italian handjob sperm several models boots (Jenna,Samantha).zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\tyrkish cum hardcore big lady .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\italian beastiality horse uncut ìï .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\sperm [bangbus] .rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\beast full movie titts 50+ .zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\american porn bukkake [bangbus] femdom (Britney,Karin).avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\russian kicking trambling hidden glans 50+ .rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\american cumshot trambling public feet .mpg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\xxx catfight titts circumcision (Curtney).mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\russian nude blowjob [bangbus] beautyfull (Sonja,Karin).mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\norwegian trambling masturbation cock .zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\indian handjob horse licking .zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\japanese nude lesbian [bangbus] feet .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\black cumshot gay sleeping Ôë .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\black animal sperm catfight feet .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\PLA\Templates\danish cumshot horse big blondie .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\indian handjob blowjob hot (!) mistress .zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\trambling sleeping .zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\danish horse beast [free] castration .zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\tyrkish animal fucking sleeping traffic .mpg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\beast sleeping pregnant .mpg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\indian nude trambling [bangbus] (Tatjana).mpg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\swedish porn lingerie uncut .zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\danish gang bang fucking [milf] cock bedroom .rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\spanish beast uncut glans .zip.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\fetish trambling big titts .mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\danish action fucking [bangbus] glans shoes .rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\brasilian handjob sperm [bangbus] lady (Sandy,Melissa).mpeg.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\xxx uncut .rar.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\fetish sperm sleeping young .avi.exe 61e002d8767d858e405ea95445ddf1b1.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\hardcore hot (!) glans .rar.exe 61e002d8767d858e405ea95445ddf1b1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe 2964 61e002d8767d858e405ea95445ddf1b1.exe 2824 61e002d8767d858e405ea95445ddf1b1.exe 1136 61e002d8767d858e405ea95445ddf1b1.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2824 2964 61e002d8767d858e405ea95445ddf1b1.exe 28 PID 2964 wrote to memory of 2824 2964 61e002d8767d858e405ea95445ddf1b1.exe 28 PID 2964 wrote to memory of 2824 2964 61e002d8767d858e405ea95445ddf1b1.exe 28 PID 2964 wrote to memory of 2824 2964 61e002d8767d858e405ea95445ddf1b1.exe 28 PID 2824 wrote to memory of 1136 2824 61e002d8767d858e405ea95445ddf1b1.exe 29 PID 2824 wrote to memory of 1136 2824 61e002d8767d858e405ea95445ddf1b1.exe 29 PID 2824 wrote to memory of 1136 2824 61e002d8767d858e405ea95445ddf1b1.exe 29 PID 2824 wrote to memory of 1136 2824 61e002d8767d858e405ea95445ddf1b1.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\61e002d8767d858e405ea95445ddf1b1.exe"C:\Users\Admin\AppData\Local\Temp\61e002d8767d858e405ea95445ddf1b1.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\61e002d8767d858e405ea95445ddf1b1.exe"C:\Users\Admin\AppData\Local\Temp\61e002d8767d858e405ea95445ddf1b1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\61e002d8767d858e405ea95445ddf1b1.exe"C:\Users\Admin\AppData\Local\Temp\61e002d8767d858e405ea95445ddf1b1.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1136
-
-