Overview
overview
10Static
static
10VirusSign....f3.exe
windows7-x64
10VirusSign....f3.exe
windows10-2004-x64
10VirusSign....ff.exe
windows7-x64
7VirusSign....ff.exe
windows10-2004-x64
7VirusSign....2d.exe
windows7-x64
1VirusSign....2d.exe
windows10-2004-x64
1VirusSign....31.exe
windows7-x64
VirusSign....31.exe
windows10-2004-x64
VirusSign....67.exe
windows7-x64
1VirusSign....67.exe
windows10-2004-x64
10VirusSign....f9.exe
windows7-x64
10VirusSign....f9.exe
windows10-2004-x64
10VirusSign....76.exe
windows7-x64
10VirusSign....76.exe
windows10-2004-x64
10VirusSign....45.exe
windows7-x64
1VirusSign....45.exe
windows10-2004-x64
1VirusSign....3a.exe
windows7-x64
10VirusSign....3a.exe
windows10-2004-x64
10VirusSign....2b.exe
windows7-x64
7VirusSign....2b.exe
windows10-2004-x64
7VirusSign....74.exe
windows7-x64
1VirusSign....74.exe
windows10-2004-x64
1VirusSign....9e.exe
windows7-x64
7VirusSign....9e.exe
windows10-2004-x64
7VirusSign....22.exe
windows7-x64
7VirusSign....22.exe
windows10-2004-x64
7VirusSign....ef.exe
windows7-x64
7VirusSign....ef.exe
windows10-2004-x64
7VirusSign....f3.exe
windows7-x64
3VirusSign....f3.exe
windows10-2004-x64
3VirusSign....d8.exe
windows7-x64
1VirusSign....d8.exe
windows10-2004-x64
7Analysis
-
max time kernel
155s -
max time network
198s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20/02/2024, 14:37
Static task
static1
Behavioral task
behavioral1
Sample
VirusSign.2024.02.08/036062de97522e2c40b04d1c1c0d5bf3.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
VirusSign.2024.02.08/036062de97522e2c40b04d1c1c0d5bf3.exe
Resource
win10v2004-20240220-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
VirusSign.2024.02.08/0366d8bc8e9bd5e64e301190356e79ff.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
VirusSign.2024.02.08/0366d8bc8e9bd5e64e301190356e79ff.exe
Resource
win10v2004-20240220-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
VirusSign.2024.02.08/0372bdc19184e4dd7461170dfb052a2d.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
VirusSign.2024.02.08/0372bdc19184e4dd7461170dfb052a2d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
VirusSign.2024.02.08/038db7a1bc9f32408eb32a8b02b5cf31.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral8
Sample
VirusSign.2024.02.08/038db7a1bc9f32408eb32a8b02b5cf31.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
VirusSign.2024.02.08/0399febb08bcbf43227bad19576af767.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral10
Sample
VirusSign.2024.02.08/0399febb08bcbf43227bad19576af767.exe
Resource
win10v2004-20240220-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
VirusSign.2024.02.08/03a3a464ef2a1fbe54b35a8effbf54f9.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
VirusSign.2024.02.08/03a3a464ef2a1fbe54b35a8effbf54f9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
VirusSign.2024.02.08/03a4ed0cb8c9721fc1369cc5f381fd76.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral14
Sample
VirusSign.2024.02.08/03a4ed0cb8c9721fc1369cc5f381fd76.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
VirusSign.2024.02.08/03af51abe00f3c6154bc829f07f83945.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
VirusSign.2024.02.08/03af51abe00f3c6154bc829f07f83945.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
VirusSign.2024.02.08/03b6a8e2d209f10cce366b73bec0283a.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral18
Sample
VirusSign.2024.02.08/03b6a8e2d209f10cce366b73bec0283a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
VirusSign.2024.02.08/03ba9978296204d2048fb184e546932b.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral20
Sample
VirusSign.2024.02.08/03ba9978296204d2048fb184e546932b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
VirusSign.2024.02.08/03e3a2fc4bf137d68962d35b23186a74.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
VirusSign.2024.02.08/03e3a2fc4bf137d68962d35b23186a74.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
VirusSign.2024.02.08/03e8dd811ff56c2ef65a494a29601f9e.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral24
Sample
VirusSign.2024.02.08/03e8dd811ff56c2ef65a494a29601f9e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
VirusSign.2024.02.08/03eec9b444ff21a20e84fa8592478c22.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral26
Sample
VirusSign.2024.02.08/03eec9b444ff21a20e84fa8592478c22.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
VirusSign.2024.02.08/04048340f3e175baa6bd71fcc12851ef.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral28
Sample
VirusSign.2024.02.08/04048340f3e175baa6bd71fcc12851ef.exe
Resource
win10v2004-20240220-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
VirusSign.2024.02.08/0409c5c4922e4b79e2017df62f632cf3.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral30
Sample
VirusSign.2024.02.08/0409c5c4922e4b79e2017df62f632cf3.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
VirusSign.2024.02.08/040dcef90aa17a406b8de190fd3330d8.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral32
Sample
VirusSign.2024.02.08/040dcef90aa17a406b8de190fd3330d8.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
VirusSign.2024.02.08/03e8dd811ff56c2ef65a494a29601f9e.exe
-
Size
278KB
-
MD5
03e8dd811ff56c2ef65a494a29601f9e
-
SHA1
04d06be2302da7b9117f8cd57821c7a98ae919fd
-
SHA256
bd31bf973af6b1c530482515829e2c7ec1451bf487d9d8891d42b2eb27dffbad
-
SHA512
c9b68d104dba1e20abffd8cbd71cc650c003872f35bc6cc1a88407f79d6c284a7120155b7a760fcfdc31e26c0b335c69918249f8f1e428c86b97cfa9fee218a6
-
SSDEEP
6144:6jluQoSFIo5R4nM/40yJoVj4QABWnmc6NGqYMeQIyi3MY9U0ht01SZ:6EQoSvqhoMZUnmcCX4Q+d9BQSZ
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral23/memory/2800-0-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral23/files/0x00030000000215da-5.dat upx behavioral23/memory/2700-25-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral23/memory/3016-63-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral23/memory/2800-92-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral23/memory/2700-97-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral23/memory/3016-102-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 03e8dd811ff56c2ef65a494a29601f9e.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\T: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\U: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\Y: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\Z: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\O: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\G: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\I: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\J: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\N: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\Q: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\R: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\V: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\A: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\X: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\H: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\L: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\W: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\E: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\K: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\M: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\P: 03e8dd811ff56c2ef65a494a29601f9e.exe File opened (read-only) \??\B: 03e8dd811ff56c2ef65a494a29601f9e.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\shared\cumshot lesbian [free] fishy .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lingerie xxx several models hole girly .rar.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\SysWOW64\FxsTmp\african fucking beast full movie hotel .rar.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\brasilian horse sperm several models cock gorgeoushorny (Anniston).mpg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\SysWOW64\FxsTmp\fucking licking YEâPSè& .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\asian fetish horse masturbation YEâPSè& .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\SysWOW64\config\systemprofile\indian animal fucking public .avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\System32\DriverStore\Temp\hardcore [milf] ash (Sonja,Sylvia).mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\SysWOW64\IME\shared\norwegian action bukkake catfight .avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\SysWOW64\config\systemprofile\sperm bukkake hidden blondie .rar.exe 03e8dd811ff56c2ef65a494a29601f9e.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fucking full movie boobs .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Program Files\Common Files\Microsoft Shared\swedish animal lesbian full movie .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\horse gang bang [bangbus] vagina (Sandy).avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\french lingerie sperm uncut .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Program Files (x86)\Google\Update\Download\danish animal fetish big (Sarah,Kathrin).mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\xxx several models pregnant .mpg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\lingerie nude [milf] glans (Ashley).zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Program Files\Windows Journal\Templates\russian nude cumshot sleeping hairy .rar.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\brasilian porn gay [free] nipples penetration (Britney).rar.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\action porn licking glans swallow (Christine,Sonja).mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Program Files\DVD Maker\Shared\swedish action trambling hidden blondie .rar.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Program Files (x86)\Google\Temp\british sperm xxx [free] cock black hairunshaved .mpg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\japanese animal [free] young .mpg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\black sperm licking vagina .rar.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Program Files (x86)\Microsoft Office\Templates\spanish beast xxx masturbation legs stockings .avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SoftwareDistribution\Download\french trambling catfight latex (Sandy,Sarah).rar.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\russian gang bang [milf] hotel .mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\hardcore horse [bangbus] bondage .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\xxx catfight sm .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\british trambling girls (Janette).zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\lesbian beastiality voyeur nipples bondage .mpg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\lingerie girls stockings .avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\handjob licking bedroom (Sylvia).zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\lingerie several models vagina .avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\japanese action lingerie big .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\Downloaded Program Files\beastiality several models .avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\animal bukkake masturbation vagina (Liz,Kathrin).mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\cum blowjob [bangbus] fishy (Curtney).avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\black xxx porn hot (!) titts lady .avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\asian gay uncut (Sonja,Sandy).mpg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\german nude horse [bangbus] redhair .rar.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\action beastiality girls hole .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\indian fucking catfight balls .avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\asian xxx hidden .mpg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\beastiality public traffic .mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\kicking [bangbus] ash traffic .mpg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\french blowjob gay sleeping (Sonja).zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\american trambling lingerie hidden .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\asian hardcore gang bang girls penetration .avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\fetish action catfight hotel .mpg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\PLA\Templates\black xxx beast sleeping titts (Jade,Tatjana).mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\beast full movie ash .rar.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\animal full movie .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\italian kicking cum [milf] black hairunshaved .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\indian fucking kicking voyeur leather .mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\african xxx hidden .mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\asian lesbian cum hot (!) .rar.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\assembly\temp\german handjob girls .avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\security\templates\animal several models glans .avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\bukkake blowjob masturbation balls (Samantha,Janette).avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\british blowjob public ash (Kathrin).rar.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\fetish handjob hot (!) feet .avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\black gay cumshot uncut YEâPSè& (Jade,Gina).mpg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\norwegian gang bang catfight .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\fetish xxx girls feet .rar.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\spanish horse fucking [free] ìï .mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\kicking beastiality hot (!) (Anniston,Tatjana).mpg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\spanish sperm porn full movie ìï .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\fucking porn several models hole .mpg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\porn nude big blondie (Sylvia).zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\indian nude bukkake lesbian .mpg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\spanish trambling hardcore catfight nipples lady (Sandy,Sandy).mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\chinese fetish cumshot big .avi.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\italian horse full movie granny .rar.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\russian gang bang [free] 50+ .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\action fetish girls shower .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\kicking several models stockings (Sylvia,Jade).mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\german blowjob bukkake hidden nipples circumcision .mpg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\asian gang bang masturbation hole .mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\horse beast sleeping hole shower .mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\lesbian uncut (Karin,Jade).mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\black horse catfight ìï .mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\mssrv.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\beast cumshot girls legs .mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\malaysia cum lesbian masturbation feet bedroom .mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\gay fetish licking cock (Jenna).mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\beastiality [free] nipples ìï (Gina).mpeg.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\xxx sperm hot (!) .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\danish handjob nude uncut young .zip.exe 03e8dd811ff56c2ef65a494a29601f9e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 3016 03e8dd811ff56c2ef65a494a29601f9e.exe 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 2800 03e8dd811ff56c2ef65a494a29601f9e.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2800 wrote to memory of 2700 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 30 PID 2800 wrote to memory of 2700 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 30 PID 2800 wrote to memory of 2700 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 30 PID 2800 wrote to memory of 2700 2800 03e8dd811ff56c2ef65a494a29601f9e.exe 30 PID 2700 wrote to memory of 3016 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 31 PID 2700 wrote to memory of 3016 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 31 PID 2700 wrote to memory of 3016 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 31 PID 2700 wrote to memory of 3016 2700 03e8dd811ff56c2ef65a494a29601f9e.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusSign.2024.02.08\03e8dd811ff56c2ef65a494a29601f9e.exe"C:\Users\Admin\AppData\Local\Temp\VirusSign.2024.02.08\03e8dd811ff56c2ef65a494a29601f9e.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\VirusSign.2024.02.08\03e8dd811ff56c2ef65a494a29601f9e.exe"C:\Users\Admin\AppData\Local\Temp\VirusSign.2024.02.08\03e8dd811ff56c2ef65a494a29601f9e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\VirusSign.2024.02.08\03e8dd811ff56c2ef65a494a29601f9e.exe"C:\Users\Admin\AppData\Local\Temp\VirusSign.2024.02.08\03e8dd811ff56c2ef65a494a29601f9e.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3016
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Sidebar\Shared Gadgets\brasilian porn gay [free] nipples penetration (Britney).rar.exe
Filesize752KB
MD5faf8b2cfb41986ea54bcd888be7961f1
SHA156b2294c27a317d912a268b76b8d231c64102b12
SHA256e03f7396659069282bb761e69d97c8966801567590a8331eed03849050c27818
SHA512f3dcb5edfad41d76f4a839cdf81f0b91a352a224f3896ab286e33ba6ef046ae0deadadf501a8243992297d8fd17eef1417756ad8cc9fba42f2e514b42a1dadf5