e983456a1a1e3aea56c3eb4e982ce90daa1ad4e77b7948c71c3dae3b83ae0a99

Analysis

max time kernel
144s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

87bc02114ccbac49b90aca860fa12186.exe
Size

227KB
MD5

87bc02114ccbac49b90aca860fa12186
SHA1

e0ae0bc513125379e1a110c6350061ae2a138a65
SHA256

e983456a1a1e3aea56c3eb4e982ce90daa1ad4e77b7948c71c3dae3b83ae0a99
SHA512

d74f11b4127491cf8ba7ab809f03993f33033e96a1bb9fbb2f641605ac7da6946f5ecb98beb89b3215d3f329d6687cdb0581e58ab7a9672be321af1d0b848ad9
SSDEEP

3072:gjbLl/gvQoutp1Tj4mYWR/RMvaw3PWsiCs1qiBeLNlO8hAg4pAXqmoaBUFCIGGmm:gjluQoS3Io5RJW4ATJHupAgaZGjRSjI

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1872-0-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/files/0x0007000000016441-5.dat	upx
behavioral1/memory/2684-8-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2540-49-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2684-48-0x0000000004840000-0x0000000004860000-memory.dmp	upx
behavioral1/memory/1872-65-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2684-66-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2540-67-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1872-68-0x0000000004880000-0x00000000048A0000-memory.dmp	upx
behavioral1/memory/1872-73-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1872-77-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1872-100-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1872-103-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1872-106-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1872-109-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1872-112-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1872-115-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1872-118-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1872-122-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1872-125-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1872-128-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	87bc02114ccbac49b90aca860fa12186.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\S:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\U:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\W:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\Z:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\B:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\J:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\K:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\O:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\R:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\A:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\I:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\M:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\Y:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\L:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\N:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\V:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\P:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\T:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\X:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\E:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\G:	87bc02114ccbac49b90aca860fa12186.exe
File opened (read-only)	\??\H:	87bc02114ccbac49b90aca860fa12186.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\asian hardcore voyeur .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\SysWOW64\FxsTmp\indian handjob sperm several models titts balls .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\SysWOW64\IME\shared\russian horse blowjob [free] feet bedroom (Curtney).rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\SysWOW64\config\systemprofile\italian kicking fucking catfight leather .avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\japanese action horse lesbian hotel (Christine,Tatjana).avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\SysWOW64\IME\shared\swedish animal beast lesbian wifey .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\indian porn gay licking titts upskirt (Jade).avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\System32\DriverStore\Temp\beast girls circumcision .mpg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\SysWOW64\FxsTmp\horse [bangbus] high heels (Christine,Sarah).mpg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\SysWOW64\config\systemprofile\brasilian horse sperm lesbian hole YEâPSè& (Melissa).avi.exe	87bc02114ccbac49b90aca860fa12186.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\italian cumshot fucking public hotel .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\russian beastiality gay hot (!) hole ìï (Janette).zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Program Files (x86)\Google\Temp\russian fetish lingerie several models cock .mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\spanish horse catfight titts mistress .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\african trambling big (Jade).mpg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\gay big shower .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Program Files\Windows Journal\Templates\russian horse lesbian catfight .mpg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Program Files (x86)\Google\Update\Download\american cumshot horse catfight hole young .mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\brasilian action sperm [milf] YEâPSè& (Gina,Sylvia).avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\beast sleeping titts (Kathrin,Sylvia).mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\brasilian horse beast licking mature .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Program Files\DVD Maker\Shared\horse lesbian hole high heels (Karin).mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\russian kicking lesbian voyeur .mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\hardcore [free] feet lady .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\beast several models cock .mpg.exe	87bc02114ccbac49b90aca860fa12186.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\brasilian horse bukkake [free] mature .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\russian cum fucking several models cock .avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\danish horse bukkake [bangbus] titts .mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\trambling public blondie .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\Temp\brasilian action lesbian big .mpg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\porn lesbian sleeping gorgeoushorny .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\horse masturbation sweet .avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\blowjob public hole .avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\japanese kicking sperm public mistress (Gina,Curtney).mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\tyrkish cumshot blowjob public shower .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\cumshot xxx voyeur titts (Sandy,Tatjana).mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\chinese horse hidden circumcision .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\swedish porn blowjob [free] cock .mpg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\tyrkish action beast [bangbus] hotel .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\malaysia gay voyeur .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\norwegian xxx [milf] hole balls (Curtney).rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\chinese lesbian [milf] hole (Ashley,Tatjana).rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\tyrkish gang bang lesbian [bangbus] glans .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\black horse sperm sleeping .mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\security\templates\hardcore [free] ìï .mpg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\spanish lesbian [bangbus] hole shoes .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\cum beast voyeur feet (Sonja,Samantha).avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\blowjob catfight titts blondie .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\InstallTemp\american nude lingerie several models .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\danish gang bang lesbian public .avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\russian horse bukkake licking feet castration (Sylvia).mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\chinese blowjob full movie circumcision (Sonja,Janette).mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\beast hidden glans .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\danish animal lesbian hot (!) .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\gang bang sperm uncut hole bondage .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\italian handjob hardcore sleeping mistress .mpg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\brasilian horse beast [milf] titts fishy (Tatjana).rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\kicking beast masturbation swallow .avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\brasilian kicking sperm sleeping black hairunshaved .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\mssrv.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\hardcore several models .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\assembly\temp\swedish handjob lesbian hidden young .mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\swedish handjob xxx big mature .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\danish handjob sperm [bangbus] young .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\russian porn trambling several models leather .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\porn sperm public (Liz).avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\cumshot blowjob sleeping glans hotel (Liz).rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\xxx [bangbus] lady (Jenna,Samantha).mpg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\lesbian public 40+ .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\bukkake lesbian cock upskirt .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\canadian lingerie [bangbus] feet 40+ .avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\bukkake several models swallow .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\italian cumshot trambling girls feet ash .zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\american fetish lesbian licking glans swallow (Liz).avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\danish cum blowjob hidden black hairunshaved .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\assembly\tmp\japanese action trambling several models glans young .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\xxx girls (Jade).mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\japanese handjob bukkake [milf] boots .mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\xxx [bangbus] glans swallow (Sylvia).zip.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\beastiality sperm voyeur titts stockings .mpg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\black handjob lingerie big (Curtney).rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\russian handjob xxx public (Melissa).mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\canadian trambling full movie .avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\canadian bukkake masturbation feet .avi.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian action horse [bangbus] (Samantha).mpg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\chinese beast full movie redhair (Sonja,Janette).mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\chinese sperm uncut titts .mpeg.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\horse catfight gorgeoushorny .rar.exe	87bc02114ccbac49b90aca860fa12186.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\beast [milf] hole shoes (Curtney).mpg.exe	87bc02114ccbac49b90aca860fa12186.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe
1872	87bc02114ccbac49b90aca860fa12186.exe
2684	87bc02114ccbac49b90aca860fa12186.exe
2540	87bc02114ccbac49b90aca860fa12186.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2684	1872	87bc02114ccbac49b90aca860fa12186.exe	28
PID 1872 wrote to memory of 2684	1872	87bc02114ccbac49b90aca860fa12186.exe	28
PID 1872 wrote to memory of 2684	1872	87bc02114ccbac49b90aca860fa12186.exe	28
PID 1872 wrote to memory of 2684	1872	87bc02114ccbac49b90aca860fa12186.exe	28
PID 2684 wrote to memory of 2540	2684	87bc02114ccbac49b90aca860fa12186.exe	29
PID 2684 wrote to memory of 2540	2684	87bc02114ccbac49b90aca860fa12186.exe	29
PID 2684 wrote to memory of 2540	2684	87bc02114ccbac49b90aca860fa12186.exe	29
PID 2684 wrote to memory of 2540	2684	87bc02114ccbac49b90aca860fa12186.exe	29

C:\Users\Admin\AppData\Local\Temp\87bc02114ccbac49b90aca860fa12186.exe
"C:\Users\Admin\AppData\Local\Temp\87bc02114ccbac49b90aca860fa12186.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\87bc02114ccbac49b90aca860fa12186.exe
  "C:\Users\Admin\AppData\Local\Temp\87bc02114ccbac49b90aca860fa12186.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\87bc02114ccbac49b90aca860fa12186.exe
    "C:\Users\Admin\AppData\Local\Temp\87bc02114ccbac49b90aca860fa12186.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\spanish horse catfight titts mistress .rar.exe

Filesize
45KB

MD5
826631ed95eaa77bae143cb9264bdad0

SHA1
3d89fb8a30cbee141b229da66c27d43b448a5d49

SHA256
89855a981941f51e983b3c93ad9acbf77b1ce2f4299d805802d49011ee2a1e90

SHA512
b61337c62b0e37920ce40b0bc03dad4494ca1b31aac38e2d4e8ac48fc3f77f463e3e71df3edade7cb926edbbafdaef458c80c90ecf6e18b1321a9b53c32c624e

Download Submit
memory/1872-115-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1872-122-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1872-6-0x0000000004880000-0x00000000048A0000-memory.dmp

Filesize
128KB

Download
memory/1872-118-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1872-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1872-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1872-128-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1872-125-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1872-68-0x0000000004880000-0x00000000048A0000-memory.dmp

Filesize
128KB

Download
memory/1872-112-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1872-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1872-77-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1872-100-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1872-103-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1872-106-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1872-109-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2540-49-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2540-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2684-48-0x0000000004840000-0x0000000004860000-memory.dmp

Filesize
128KB

Download
memory/2684-72-0x0000000004840000-0x0000000004860000-memory.dmp

Filesize
128KB

Download
memory/2684-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2684-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download