Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/03/2024, 10:45
Behavioral task
behavioral1
Sample
virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe
- Size 85KB
- Sample240303-mttjgshg86
- SHA256 c0ec2620314a3ca97617ad0142a314a433f819b5a69247a19938bce8c6d48bd1
- MD5 afb1c7746ddc30387ca9b2f19897d9c7
- SHA1 bb74f9e6d33ca9185a18b0aae5404b9619ad604a
- SHA512 0ab0d30ee685291f1ca3f9bcf6143ab2e5307ec438a4acad92e1c2660d7f976538db3fe5dfe94bf29a721292b52480c01b429fae6f9790db15e13c3ef0750be2
- SSDEEP 1536:/RVCaKgzbLc54hukfgvqnDFdorV1Ayj4m/QWR/Rlq88vlnRqPR/1aViDRknJM2SX:JjbLl/gvyDFep1Tj4mYWR/R4nkPR/1aG
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Detects executables containing possible sandbox analysis VM usernames 19 IoCs
resource yara_rule behavioral2/memory/4808-65-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4564-158-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-184-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4808-185-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4564-186-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-188-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-189-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-194-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-203-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-206-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-210-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-213-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-216-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-219-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-222-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-225-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-228-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-231-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3004-234-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames - UPX dump on OEP (original entry point) 21 IoCs
resource yara_rule behavioral2/memory/3004-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/files/0x00070000000231ff-5.dat UPX behavioral2/memory/4808-65-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4564-158-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-184-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4808-185-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4564-186-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-188-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-189-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-194-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-203-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-206-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-210-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-213-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-216-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-219-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-222-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-225-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-228-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-231-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3004-234-0x0000000000400000-0x000000000041E000-memory.dmp UPX - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3004-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/files/0x00070000000231ff-5.dat upx behavioral2/memory/4808-65-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4564-158-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-184-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4808-185-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4564-186-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-188-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-189-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-194-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-203-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-206-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-210-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-213-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-216-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-219-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-222-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-225-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-228-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-231-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3004-234-0x0000000000400000-0x000000000041E000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\L: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\M: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\T: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\W: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\Y: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\H: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\J: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\K: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\O: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\Q: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\R: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\A: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\N: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\P: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\S: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\U: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\X: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\E: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\G: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\I: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\V: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File opened (read-only) \??\Z: virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\malaysia horse [free] titts .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\SysWOW64\FxsTmp\beastiality nude lesbian titts swallow .zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\SysWOW64\IME\SHARED\malaysia kicking porn sleeping circumcision .mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\SysWOW64\config\systemprofile\trambling cumshot girls (Christine).mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\SysWOW64\FxsTmp\danish trambling sleeping sm (Sylvia,Sylvia).rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\SysWOW64\IME\SHARED\brasilian nude sperm full movie .zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\SysWOW64\config\systemprofile\brasilian beastiality sperm several models .avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\gang bang [milf] shoes .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\chinese gang bang masturbation (Jade,Kathrin).mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\System32\DriverStore\Temp\danish horse xxx catfight .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\horse porn lesbian boots .mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\horse horse lesbian bondage .mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe - Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\cumshot [milf] traffic .avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\trambling lesbian black hairunshaved (Curtney,Melissa).avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\canadian blowjob masturbation .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files\Microsoft Office\Updates\Download\blowjob cumshot hidden ash (Christine,Janette).avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files (x86)\Google\Update\Download\malaysia gang bang big .avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files (x86)\Microsoft\Temp\russian lesbian full movie mature (Sonja).rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\brasilian nude girls swallow .mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\french sperm public hole (Anniston,Samantha).mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\action [bangbus] penetration .avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\trambling lesbian masturbation ,Ó .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files (x86)\Google\Temp\german gay big young (Sarah).mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sperm xxx voyeur cock gorgeoushorny .zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files\Common Files\microsoft shared\russian horse full movie circumcision (Kathrin,Jade).mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files\dotnet\shared\indian beast public lady .zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\trambling beast public young .mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\indian gay public mature .avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files\Microsoft Office\root\Templates\indian cum beast sleeping hole swallow .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\african bukkake fucking lesbian boots .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\blowjob uncut leather (Karin).mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\chinese blowjob hidden .mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\norwegian trambling trambling catfight glans lady .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\sperm [milf] young (Britney).zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\asian blowjob hardcore hot (!) redhair .avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\sperm gang bang [free] (Samantha,Karin).zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\beast full movie (Tatjana,Sonja).avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\german hardcore catfight .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\black fucking hidden feet redhair .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\italian sperm several models cock circumcision .mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\trambling hot (!) beautyfull (Sonja,Christine).rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\american trambling big ash (Kathrin).mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\cumshot cumshot masturbation bedroom .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\swedish kicking [bangbus] mature .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\gay handjob full movie legs latex .mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\british animal lesbian legs femdom .mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\indian animal horse uncut lady .mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_c9ce604ef4cbf323\xxx fucking public legs mature (Janette,Jade).mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\lingerie public ash boots .zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\black blowjob catfight boobs (Tatjana).rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\fetish trambling [free] boots .avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\italian blowjob big hairy .zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\SoftwareDistribution\Download\bukkake lingerie girls (Anniston,Samantha).zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\tyrkish lesbian [free] ash .avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\trambling cumshot hot (!) nipples (Jade,Jade).zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\norwegian fetish fucking public .zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\danish lingerie action full movie granny .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\african fucking sperm [free] ash stockings (Liz,Ashley).avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\indian hardcore [free] .mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\horse voyeur femdom (Karin).mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\spanish trambling voyeur hotel .zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\brasilian nude [milf] ejaculation (Britney,Anniston).rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\danish hardcore handjob uncut legs YEâPSè& .avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\cum masturbation shoes .zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\PLA\Templates\russian gay cum girls penetration .avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\norwegian animal cum several models nipples hotel (Britney,Jenna).rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\swedish horse catfight boobs boots .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\chinese beast voyeur ejaculation .zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\handjob lesbian feet .mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\chinese gang bang horse lesbian stockings (Britney).mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\lingerie lesbian beautyfull .mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\cumshot [milf] .avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\security\templates\kicking hardcore hidden (Tatjana,Britney).rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\blowjob horse hidden nipples mistress .avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\fetish trambling licking (Tatjana,Sandy).zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\kicking horse girls feet ash .mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\african horse blowjob big legs circumcision .mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\african blowjob blowjob big (Curtney,Samantha).rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\horse [milf] shower .zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\american sperm several models YEâPSè& .mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\animal beastiality public wifey .avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\gay hardcore big .mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\malaysia gay [free] shower .avi.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\fucking girls latex .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\american lingerie gang bang sleeping titts .zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\british fucking full movie ejaculation .mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\CbsTemp\hardcore masturbation young .mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\brasilian beastiality hot (!) nipples ejaculation (Gina).mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\beast action [free] cock black hairunshaved .rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\malaysia horse full movie boobs penetration .zip.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\spanish horse catfight wifey .mpg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\italian porn public feet beautyfull (Jenna).rar.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\hardcore handjob licking cock shower .mpeg.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe File created C:\Windows\mssrv.exe virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 4564 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3004 wrote to memory of 4808 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 92 PID 3004 wrote to memory of 4808 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 92 PID 3004 wrote to memory of 4808 3004 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 92 PID 4808 wrote to memory of 4564 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 95 PID 4808 wrote to memory of 4564 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 95 PID 4808 wrote to memory of 4564 4808 virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe"C:\Users\Admin\AppData\Local\Temp\virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe"C:\Users\Admin\AppData\Local\Temp\virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe"C:\Users\Admin\AppData\Local\Temp\virussign.com_afb1c7746ddc30387ca9b2f19897d9c7.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4564
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\african bukkake fucking lesbian boots .rar.exe
- Size 1.5MB
- SHA256 db698ba6fbcd823bbe016a507353c96ded06ee57667776f9a9b7ef61c209417c
- MD5 0ba756d3c6bd6bef20c03bb935fce05b
- SHA1 f241300c26803af24a43d0f502a044bb3165666b
- SHA512 7586d7a2e971a7def2c6c67f960864d0c96ba07f77f4e42e7b0141b744f51664e46a671611782f6aa6074c9de11d58f7ff26f98a4c65044b0766e6da4d121400
- SSDEEP 49152:Pcufe/bqZ2B2ue1A3QUbXoT/qHUw8JObCSIsGZMX8M7he:Pcufe/btB2N+4T/qH4s2dMX8Ce
- MD5 SHA1 SHA512 SSDEEP