Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 09:58
Behavioral task
behavioral1
Sample
d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe
Resource
win10v2004-20240226-en
General
-
Target
d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe
-
Size
1.3MB
-
MD5
c2cfd76b9603ea4c1059e48898422f9e
-
SHA1
bf65cc1f8e6e0420f8b59df36fc5690e0bbf3507
-
SHA256
d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479
-
SHA512
dc3cf4387895b89607de6ef7d8cdc34c6b34213603797363c23dbe7dcec705c44890d376cbca0fba377efe75c8ded530daaee8de71c0ece2678f23e3a5266617
-
SSDEEP
24576:gp+jbOhrm4Fml1U5jW/zaOUs0lxCThawmnMIi3jZ1sbdMjtKpNbeooiC:NPC54l656LaKixCUwqJiXspMApg
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 17 IoCs
resource yara_rule behavioral1/memory/2436-77-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2800-89-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-91-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-104-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-105-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-109-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-112-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-115-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-120-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-123-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-126-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-129-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-132-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-135-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-138-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-141-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-144-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral1/memory/1888-0-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/files/0x0007000000015ce1-5.dat UPX behavioral1/memory/1888-76-0x0000000004790000-0x00000000047B0000-memory.dmp UPX behavioral1/memory/2436-77-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/2800-89-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-91-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-104-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-105-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-109-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-112-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-115-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-120-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-123-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-126-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-129-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-132-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-135-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-138-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-141-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/1888-144-0x0000000000400000-0x0000000000420000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1888-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x0007000000015ce1-5.dat upx behavioral1/memory/1888-76-0x0000000004790000-0x00000000047B0000-memory.dmp upx behavioral1/memory/2436-77-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2800-89-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-91-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-104-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-105-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-109-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-112-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-115-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-120-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-123-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-126-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-129-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-132-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-135-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-138-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-141-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1888-144-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\S: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\W: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\A: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\H: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\K: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\P: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\N: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\X: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\E: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\G: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\J: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\M: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\Y: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\Z: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\O: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\T: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\U: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\V: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\B: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\I: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\L: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File opened (read-only) \??\Q: d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\beast catfight shower .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\System32\DriverStore\Temp\brasilian gang bang fucking [milf] glans mistress .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\SysWOW64\IME\shared\danish porn beast licking pregnant (Gina,Curtney).mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\hardcore several models bondage (Christine,Tatjana).zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\SysWOW64\FxsTmp\russian fetish lingerie girls beautyfull (Ashley,Janette).mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\SysWOW64\IME\shared\brasilian horse trambling [bangbus] (Samantha).rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\SysWOW64\config\systemprofile\russian cumshot fucking full movie gorgeoushorny .mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\SysWOW64\FxsTmp\chinese xxx voyeur shoes .mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\american cum fucking [bangbus] (Jade).zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\SysWOW64\config\systemprofile\lingerie [bangbus] glans .mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Temp\black fetish lesbian [free] shower .rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\lingerie hot (!) .avi.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\horse lesbian feet sweet .mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\italian cumshot lingerie masturbation stockings (Sonja,Curtney).mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\beast catfight titts .avi.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\black cumshot gay [milf] cock redhair (Samantha).rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Program Files (x86)\Common Files\microsoft shared\sperm full movie titts leather .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Program Files (x86)\Google\Update\Download\danish fetish sperm [milf] titts .mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\indian cumshot hardcore masturbation shower (Jenna,Sylvia).avi.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\blowjob public girly .avi.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Program Files\Common Files\Microsoft Shared\danish fetish gay [bangbus] (Liz).mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\indian nude beast several models glans .mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Program Files\DVD Maker\Shared\gay full movie mistress .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Program Files\Windows Journal\Templates\gay [milf] .avi.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Program Files (x86)\Microsoft Office\Templates\gay catfight traffic (Anniston,Janette).rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\lesbian hot (!) YEâPSè& .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\fucking girls titts .mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\spanish horse public cock mistress (Tatjana).rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\InstallTemp\action lingerie voyeur hole boots .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\beast uncut .rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\black kicking xxx licking glans upskirt (Liz).mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\hardcore public 40+ .rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\horse gay licking glans .avi.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\canadian xxx big (Curtney).rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\canadian beast [free] hairy .mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\swedish horse lesbian licking (Tatjana).mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\fucking several models black hairunshaved .avi.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\norwegian blowjob hidden blondie .rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\indian nude bukkake licking .mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\assembly\tmp\hardcore big swallow .rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\fucking catfight castration .rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\kicking lesbian catfight (Liz).mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\japanese animal xxx licking black hairunshaved .mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\cumshot bukkake uncut hole .rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\blowjob [bangbus] titts fishy (Tatjana).mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\nude sperm uncut feet wifey (Sarah).avi.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\black horse fucking full movie lady .avi.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\russian cum blowjob big latex .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\japanese action bukkake full movie (Sylvia).mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\swedish animal horse licking hole ash .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\beast girls .mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\indian nude lingerie licking hole black hairunshaved (Curtney).zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\brasilian gang bang blowjob uncut (Samantha).zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\indian cumshot xxx full movie feet .mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\handjob beast several models .mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\indian handjob beast several models .mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\blowjob catfight cock boots .mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\lesbian [milf] glans penetration (Samantha).rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\brasilian cumshot horse uncut glans bedroom .avi.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\hardcore uncut (Janette).mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\british bukkake licking glans redhair .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\norwegian xxx big ìï .mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\cumshot lesbian [milf] .mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\handjob sperm public .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\danish gang bang trambling catfight girly .mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\blowjob hot (!) penetration .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\horse hardcore sleeping (Janette).mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\lesbian sleeping hole gorgeoushorny (Curtney).mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\american gang bang fucking [bangbus] (Sarah).zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\lesbian [milf] .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\brasilian handjob lesbian [bangbus] titts wifey .mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\SoftwareDistribution\Download\blowjob big titts bedroom .mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\horse catfight (Liz).rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\xxx licking .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\xxx hidden sweet .mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\spanish blowjob [free] feet beautyfull (Sylvia).zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\spanish horse [bangbus] .rar.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\swedish action sperm hidden swallow .mpeg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\gay public sm .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\lingerie girls glans 50+ .avi.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\fetish gay public bondage .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\danish animal beast masturbation .avi.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\danish cumshot blowjob several models feet .mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\malaysia fucking lesbian cock .avi.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\canadian blowjob catfight glans .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\norwegian xxx [free] titts traffic (Samantha).mpg.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\mssrv.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\american gang bang xxx uncut titts .avi.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\american beastiality fucking [free] .zip.exe d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 2800 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2436 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 28 PID 1888 wrote to memory of 2436 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 28 PID 1888 wrote to memory of 2436 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 28 PID 1888 wrote to memory of 2436 1888 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 28 PID 2436 wrote to memory of 2800 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 29 PID 2436 wrote to memory of 2800 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 29 PID 2436 wrote to memory of 2800 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 29 PID 2436 wrote to memory of 2800 2436 d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe"C:\Users\Admin\AppData\Local\Temp\d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe"C:\Users\Admin\AppData\Local\Temp\d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe"C:\Users\Admin\AppData\Local\Temp\d59d6ec4e36b7d8175002ec2dee26486d93105fadb601d21f2dfcdf08e104479.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2800
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
361KB
MD5084e01f2056387efbd527ad6e3e89688
SHA15a076ccab582bd445694f886a4799a3201419d13
SHA256e7f598e872922c86cc0fe699de9589e187c4539dcae27c0afbd12f824cbfbb50
SHA512fde05bf0a68d39571cbc610977b2581e528e9373c942fcbf2d025322210d902aa31ef9368400760acec88a6975e90c29ae903ae4679c6fe4417b741ee38a332d