Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/04/2024, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe
Resource
win10v2004-20231215-en
General
-
Target
21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe
-
Size
385KB
-
MD5
1510c7e79d87db55f1a78fbc9349ad14
-
SHA1
b8e0ea6ea4da8c22a56acbe968d2b3d530be4859
-
SHA256
21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b
-
SHA512
7131a2a990f0dc77f5aa8c67e135317e6cc1146834ade0c443d2cb727e380abbc38b251e55d79970fedb0e88cd3058b0dc04ffc87c96004d20f1a77af6ef88cc
-
SSDEEP
6144:dXC4vgmhbIxs3NBB/EM4D7sJ5XyeY9+BpTNoSJ3/6bY0wAqMQ+vM0vi0ipad4O6i:dXCNi9BGMJ7nVF/60kqMVrvirs59
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 4 IoCs
resource yara_rule behavioral1/memory/3028-0-0x0000000000400000-0x000000000042B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/files/0x0007000000014f71-5.dat INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2588-42-0x0000000000400000-0x000000000042B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1836-79-0x0000000000400000-0x000000000042B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\Y: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\G: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\H: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\T: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\U: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\Z: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\O: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\Q: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\M: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\N: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\V: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\X: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\A: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\E: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\J: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\L: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\P: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\R: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\S: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\W: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\B: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\I: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\trambling licking feet .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\System32\DriverStore\Temp\hardcore hot (!) cock femdom .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\FxsTmp\malaysia horse [milf] .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\IME\shared\xxx [bangbus] titts hotel (Sarah).avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\config\systemprofile\gay big cock granny (Samantha).mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\IME\shared\bukkake [milf] .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\config\systemprofile\lingerie masturbation feet gorgeoushorny .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\beast catfight shoes .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\swedish cum beast full movie ejaculation .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\FxsTmp\swedish porn lesbian sleeping cock .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\microsoft shared\lesbian full movie feet (Sandy,Sylvia).mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Microsoft Office\Templates\swedish cumshot gay catfight .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\danish action hardcore licking titts black hairunshaved (Liz).mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\xxx full movie ¼ç .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Google\Temp\brasilian porn lingerie public feet upskirt (Janette).rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\japanese fetish bukkake hot (!) upskirt .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\trambling [milf] .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\sperm girls cock YEâPSè& .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files\Windows Journal\Templates\russian fetish lingerie public .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\russian horse gay hot (!) hairy .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\italian nude lesbian sleeping .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\action hardcore voyeur .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files\Common Files\Microsoft Shared\horse big cock .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files\DVD Maker\Shared\indian porn sperm uncut YEâPSè& .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Google\Update\Download\swedish kicking horse voyeur feet wifey (Curtney).mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\spanish fucking girls latex .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\spanish horse masturbation titts castration .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\italian cum fucking catfight (Samantha).mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\canadian beast masturbation upskirt .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\chinese bukkake voyeur boots .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian gang bang blowjob uncut glans upskirt .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\blowjob lesbian glans bondage (Jade).mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\trambling [milf] titts .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\fetish xxx lesbian .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\malaysia bukkake full movie titts high heels (Tatjana).avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\sperm girls feet .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\black handjob lingerie catfight castration .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\canadian blowjob uncut cock (Britney,Melissa).zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\black porn beast voyeur glans .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\spanish horse [free] cock circumcision .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\german blowjob licking cock hotel (Samantha).zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\asian xxx voyeur hole mature .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\Temp\blowjob girls hole .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\swedish gang bang lesbian big blondie .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\brasilian nude horse licking girly .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\fetish horse voyeur glans .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\spanish horse full movie feet sm .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\spanish sperm voyeur (Sarah).rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\InstallTemp\animal hardcore big (Sarah).avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\malaysia lingerie public titts femdom .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\malaysia horse [milf] (Curtney).avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\indian horse hardcore several models .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\animal blowjob masturbation YEâPSè& .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\black fetish beast [free] .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\trambling public .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\danish gang bang beast several models leather .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\horse licking (Samantha).zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\xxx girls YEâPSè& .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\nude beast full movie .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\handjob horse full movie blondie (Christine,Liz).rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\african hardcore [bangbus] titts fishy .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\danish horse beast public (Janette).mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\french lingerie catfight glans .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\danish cum hardcore licking leather (Jenna,Sarah).mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\russian cum trambling licking (Sylvia).avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\canadian trambling masturbation hole young .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\french bukkake big hole gorgeoushorny .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\indian fetish hardcore girls (Jade).mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\PLA\Templates\fucking several models glans .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\nude horse public cock blondie (Liz).mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\blowjob girls (Tatjana).mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\black kicking sperm voyeur feet shoes .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\indian nude trambling hot (!) hairy .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\malaysia blowjob hidden (Liz).mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\Downloaded Program Files\italian animal xxx several models young .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\swedish cumshot gay masturbation swallow .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\horse [free] 50+ .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\beast masturbation cock .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SoftwareDistribution\Download\black handjob lingerie hidden (Sarah).avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\action beast public .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\lesbian catfight feet .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\gay public hole .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\brasilian action bukkake masturbation redhair .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\mssrv.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\tyrkish porn fucking full movie leather .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\asian horse licking swallow .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\xxx lesbian upskirt .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\brasilian horse blowjob voyeur wifey .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\assembly\temp\tyrkish kicking beast licking titts high heels .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1836 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2588 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 28 PID 3028 wrote to memory of 2588 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 28 PID 3028 wrote to memory of 2588 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 28 PID 3028 wrote to memory of 2588 3028 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 28 PID 2588 wrote to memory of 1836 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 29 PID 2588 wrote to memory of 1836 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 29 PID 2588 wrote to memory of 1836 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 29 PID 2588 wrote to memory of 1836 2588 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1836
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\microsoft shared\lesbian full movie feet (Sandy,Sylvia).mpeg.exe
Filesize1.9MB
MD51d29952cd372fbece9f22944f3c4d116
SHA1ae25625bcd24834f4e19457d1bd3b14ddb278aee
SHA25658de123f1cb3efc1f3840557db6ae92b87c60558b08e31143c58a93e0b3ea767
SHA512b60ee6db46a565a6cf70d9ab76e673d39ed2da988e24a711c51a900eef7ba02f797188d9fea80b54b5145d717ead84d7db9a3026ded7616683e9f1edb0f4bcd7