Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-03-2024 22:40
Behavioral task
behavioral1
Sample
6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe
Resource
win10v2004-20240226-en
General
-
Target
6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe
-
Size
1.3MB
-
MD5
9293c9f4a44b1f66fb4a2db53d1a492f
-
SHA1
69ed2ef52fed79e4c146e902f7b1b7a0d7035ef0
-
SHA256
6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408
-
SHA512
fc19f7f89f4281f07f5f0fea4ee4d992657d73fa5f2fc8a43bbe7458aeabf062bc421943068172505459218f7be54ec3993e4d55a0c809d957acfa6fa35d2dc8
-
SSDEEP
24576:xnxD0jNNZJR+VzYv8aqNCjKLvfpfZkyOf2yAy6+ohyFq1H/J+OszbQRsB:FZ6Nl+VUvdeAyIRwWq1H/J+jbQR6
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 4 IoCs
resource yara_rule behavioral1/memory/2412-91-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1984-107-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2372-111-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2412-113-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 8 IoCs
resource yara_rule behavioral1/memory/1984-0-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral1/files/0x002d0000000149ea-5.dat UPX behavioral1/memory/1984-65-0x0000000004AB0000-0x0000000004ACD000-memory.dmp UPX behavioral1/memory/2372-66-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral1/memory/2412-91-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral1/memory/1984-107-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral1/memory/2372-111-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral1/memory/2412-113-0x0000000000400000-0x000000000041D000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1984-0-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/files/0x002d0000000149ea-5.dat upx behavioral1/memory/1984-65-0x0000000004AB0000-0x0000000004ACD000-memory.dmp upx behavioral1/memory/2372-66-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2412-91-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1984-107-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2372-111-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2412-113-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\O: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\B: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\J: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\M: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\I: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\R: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\T: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\V: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\W: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\A: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\G: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\H: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\X: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\Z: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\Y: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\E: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\Q: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\U: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\S: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\K: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\L: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File opened (read-only) \??\P: 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\kicking handjob public vagina stockings .rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\chinese beast voyeur young (Sylvia,Sonja).rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\SysWOW64\config\systemprofile\handjob full movie hole high heels .rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\SysWOW64\IME\shared\xxx [free] vagina 40+ (Tatjana).rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\System32\DriverStore\Temp\brasilian cumshot animal uncut boobs stockings .avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\SysWOW64\FxsTmp\indian nude hot (!) .rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\SysWOW64\IME\shared\italian beast catfight hotel .mpg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\danish hardcore handjob [bangbus] girly .rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\japanese hardcore voyeur traffic .mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\SysWOW64\FxsTmp\gang bang hidden ash (Janette).rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\gay bukkake hidden boobs (Melissa).mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Program Files (x86)\Common Files\microsoft shared\canadian fetish [milf] beautyfull .zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Program Files (x86)\Google\Update\Download\porn public glans .mpg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\brasilian beastiality masturbation 50+ (Samantha,Sonja).zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\danish animal public upskirt .avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Program Files\Common Files\Microsoft Shared\tyrkish porn lingerie public feet 50+ (Ashley).rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Program Files\DVD Maker\Shared\xxx licking stockings (Curtney).avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Program Files (x86)\Google\Temp\beast full movie (Gina).mpg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Program Files\Windows Journal\Templates\tyrkish handjob porn hot (!) circumcision .rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\lingerie several models stockings (Jenna).avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\danish fucking licking boots (Karin,Janette).rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\malaysia nude catfight (Janette).mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\porn masturbation .avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\brasilian porn hidden glans mistress .rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Program Files (x86)\Microsoft Office\Templates\canadian fetish action several models (Jade).avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\gay full movie bedroom .zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\beastiality several models castration (Sonja).mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\gay gang bang voyeur redhair .avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\american gang bang horse sleeping nipples black hairunshaved .mpg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\sperm horse uncut ash boots .zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\german nude kicking voyeur (Samantha,Sarah).rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\danish fetish lesbian catfight ash leather .rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\lesbian beast lesbian ìï .avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\tyrkish action full movie vagina .avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\malaysia lingerie fetish hidden hole lady (Sylvia).mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\handjob horse masturbation (Anniston,Sarah).avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\british beastiality beast uncut .mpg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\french sperm several models .zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\mssrv.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\gang bang [bangbus] high heels .avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\american hardcore hidden shoes .zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\animal masturbation legs pregnant (Liz,Tatjana).mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\american gang bang cumshot catfight redhair .avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\british trambling porn licking .avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\Downloaded Program Files\norwegian fetish cumshot [milf] .zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\asian kicking sleeping balls .zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\cum several models (Christine,Sarah).zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\nude kicking several models young .mpg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\lingerie gang bang licking traffic .mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\action kicking hot (!) feet latex (Christine,Sandy).avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\bukkake bukkake [milf] upskirt .mpg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\animal horse [free] (Ashley).zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\indian horse lesbian several models legs castration (Christine,Tatjana).mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\danish kicking public femdom (Tatjana,Kathrin).rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\cum catfight (Sonja,Jade).avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\InstallTemp\bukkake hardcore big granny .mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\Temp\malaysia hardcore lesbian legs (Liz,Liz).mpg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\norwegian fetish [free] nipples .zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\xxx gay masturbation .rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\spanish action lesbian uncut titts .rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\russian xxx masturbation (Sonja,Janette).mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\swedish blowjob lingerie girls redhair (Liz,Kathrin).mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\black cumshot public (Anniston,Curtney).mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\xxx cum girls cock (Karin).rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\horse several models ash .mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\american beastiality beast lesbian legs circumcision (Jenna).avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\gang bang gang bang masturbation vagina .mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\german kicking lesbian fishy .zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\lingerie lesbian [free] titts redhair .mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\chinese blowjob beastiality full movie girly .mpg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\danish animal [bangbus] fishy (Sarah,Curtney).mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\hardcore nude uncut (Melissa).avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\asian fetish kicking licking hairy .zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\brasilian cumshot masturbation high heels .avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\french nude animal masturbation beautyfull .zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\lingerie girls 50+ .avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\fetish trambling girls .avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\PLA\Templates\chinese lingerie animal catfight ash (Christine,Sonja).mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\lingerie porn lesbian vagina .mpg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\swedish cum horse girls sm .mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\asian blowjob beast [free] granny (Janette).zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\lesbian voyeur shower (Sylvia).avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\handjob beastiality big vagina YEâPSè& .avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\tyrkish beastiality bukkake sleeping pregnant (Tatjana,Tatjana).avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\horse handjob [free] hairy .zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\brasilian animal horse several models nipples .mpeg.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\sperm [free] boobs balls (Karin,Britney).avi.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\SoftwareDistribution\Download\chinese hardcore horse uncut lady .zip.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\nude [bangbus] feet (Christine).rar.exe 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 2412 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2372 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 28 PID 1984 wrote to memory of 2372 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 28 PID 1984 wrote to memory of 2372 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 28 PID 1984 wrote to memory of 2372 1984 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 28 PID 2372 wrote to memory of 2412 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 29 PID 2372 wrote to memory of 2412 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 29 PID 2372 wrote to memory of 2412 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 29 PID 2372 wrote to memory of 2412 2372 6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe"C:\Users\Admin\AppData\Local\Temp\6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe"C:\Users\Admin\AppData\Local\Temp\6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe"C:\Users\Admin\AppData\Local\Temp\6e3e41ca7b092d13e07c8a555245d5c2755510e2d782c65e265ccaaa0edae408.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2412
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5f668e6d46c2dc0b37b3bcc0e5874f4a9
SHA1a643da185db7141dda0c3185277b9f68e536821d
SHA256af97383157077dafa7316cf9e9fc4b1757d0492f1f0cd979134393ddc415cfb4
SHA512b4d9eb6dad1bf515a4c18ded22b180ca52647d16e0de597a150beb1152e16d502d7f8e0f5c9d1433f693d1ea747bed22d9ff6e7f7fc8f104f2070642a7920946