Analysis
-
max time kernel
154s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/04/2024, 18:40
Static task
static1
Behavioral task
behavioral1
Sample
0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe
Resource
win10v2004-20240226-en
General
-
Target
0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe
-
Size
425KB
-
MD5
1d18f9631b672a1ae46add784f948ad2
-
SHA1
865fb09938eb0d0448b64e4f9dfdd4f660bd5c22
-
SHA256
0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930
-
SHA512
ed3576b54774db6ac61a3b7b2011c8cede65b9e5b01b3983e5c52dc48ab5704b020120e3437e0ca0951950dede542c8764fb6898c3bb677e25c3e95c24a2868c
-
SSDEEP
6144:aDOxZXrSHXUTsmYAWPrY+03KuC2gFb7zD/vQMzqWkCEAydaHZ3kFe5RimDoD5Zrb:lXa8sKWPZvhDAJWFry85ue7iSoDrkS1f
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 18 IoCs
resource yara_rule behavioral1/memory/2068-6-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2484-54-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-67-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2068-80-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-89-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-90-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-95-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-98-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-101-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-105-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-110-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-121-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-124-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-127-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-130-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-135-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-138-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2144-141-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 22 IoCs
resource yara_rule behavioral1/memory/2144-0-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-5-0x0000000004A50000-0x0000000004A6C000-memory.dmp UPX behavioral1/memory/2068-6-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/files/0x000700000001497e-7.dat UPX behavioral1/memory/2484-54-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-67-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2068-80-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-89-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-90-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-91-0x0000000004A50000-0x0000000004A6C000-memory.dmp UPX behavioral1/memory/2144-95-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-98-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-101-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-105-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-110-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-121-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-124-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-127-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-130-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-135-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-138-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2144-141-0x0000000000400000-0x000000000041C000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\J: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\K: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\L: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\R: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\T: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\V: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\W: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\Z: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\H: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\N: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\U: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\X: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\Y: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\B: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\M: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\O: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\P: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\Q: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\S: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\A: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\E: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\G: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\FxsTmp\sperm lesbian licking boobs high heels .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\african porn cumshot hidden young (Curtney).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\FxsTmp\gay sperm hot (!) young (Sonja).mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\IME\shared\cum fetish [bangbus] boobs Ôë .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\cum big .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\System32\DriverStore\Temp\african horse catfight .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\IME\shared\russian beastiality bukkake voyeur shoes (Liz).zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\horse lesbian several models feet castration (Sonja,Melissa).avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\config\systemprofile\trambling hot (!) redhair (Liz,Anniston).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\config\systemprofile\canadian lesbian trambling [bangbus] upskirt (Gina,Sandy).zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\nude beast sleeping (Britney).avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\blowjob uncut upskirt (Britney,Samantha).mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files\DVD Maker\Shared\tyrkish horse trambling [milf] stockings (Melissa).mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files\Windows Journal\Templates\chinese horse catfight .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\horse xxx voyeur 40+ .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\french cumshot uncut young .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\danish trambling catfight .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Common Files\microsoft shared\porn sleeping feet granny .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Google\Temp\tyrkish nude fetish public wifey (Melissa).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Google\Update\Download\xxx full movie titts circumcision .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files\Common Files\Microsoft Shared\spanish horse beastiality uncut vagina blondie .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\danish hardcore masturbation mistress .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\brasilian fucking several models ash girly .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\american lingerie bukkake girls circumcision (Jenna).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Microsoft Office\Templates\french fetish kicking [free] ash redhair (Kathrin,Anniston).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\canadian cum action catfight legs .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\swedish fetish [milf] nipples granny .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\french lesbian girls (Jenna,Janette).zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\canadian nude horse hot (!) high heels .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\brasilian cum action catfight lady (Sandy).mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\Downloaded Program Files\asian sperm full movie titts blondie .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\spanish cumshot beastiality uncut gorgeoushorny (Jenna,Kathrin).avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\cum beast [bangbus] .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\fetish sleeping ¼ç .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\bukkake fucking licking (Sonja,Curtney).mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\african xxx masturbation glans ejaculation .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\canadian porn sperm [free] titts YEâPSè& (Kathrin,Sonja).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\russian porn sperm full movie black hairunshaved .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\horse public boots .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\blowjob sleeping (Melissa,Melissa).mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\canadian sperm sleeping titts swallow .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\cum fucking [milf] cock latex .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\lingerie action uncut castration (Jade).mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\german cumshot hidden vagina sweet .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\nude catfight .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\chinese lingerie gay lesbian feet redhair .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\danish blowjob catfight boobs .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\british gay cum [bangbus] nipples black hairunshaved .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\lesbian animal voyeur legs (Sonja).zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\cumshot public (Kathrin).mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\beast horse lesbian penetration .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\beast trambling full movie .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\swedish beastiality animal [milf] .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\bukkake big shoes (Gina,Sandy).mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\horse lesbian latex .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\gay horse [bangbus] YEâPSè& .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\beastiality lesbian licking latex .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\action trambling licking circumcision .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\indian animal lingerie hidden beautyfull .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\bukkake beast full movie circumcision .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\horse licking bondage .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\black cum catfight legs shower (Britney).zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\horse kicking big .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\action full movie penetration .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\spanish action action uncut latex .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\lesbian [milf] hole lady .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian xxx action public shower .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\cumshot cumshot girls feet circumcision (Christine,Sandy).mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\spanish action xxx big .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\action blowjob voyeur feet bondage (Janette,Curtney).zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\danish lesbian handjob [milf] .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\security\templates\cumshot sleeping legs ìï (Kathrin).mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\german xxx licking ash hairy .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\spanish trambling girls feet hotel (Janette,Sandy).mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SoftwareDistribution\Download\malaysia action beastiality voyeur YEâPSè& .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\french fetish beastiality catfight ejaculation .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\norwegian handjob trambling [bangbus] .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\french gay [milf] (Janette,Sonja).zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\bukkake handjob [bangbus] upskirt (Melissa,Samantha).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\animal several models swallow .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\spanish kicking horse hidden (Samantha,Liz).mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\gay big titts .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\porn lingerie [bangbus] ejaculation (Britney).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\russian blowjob lingerie girls penetration (Britney,Janette).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\fetish voyeur circumcision .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\mssrv.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\german cumshot [milf] lady .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\action uncut blondie .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\hardcore [milf] .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2484 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2144 wrote to memory of 2068 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 28 PID 2144 wrote to memory of 2068 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 28 PID 2144 wrote to memory of 2068 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 28 PID 2144 wrote to memory of 2068 2144 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 28 PID 2068 wrote to memory of 2484 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 29 PID 2068 wrote to memory of 2484 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 29 PID 2068 wrote to memory of 2484 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 29 PID 2068 wrote to memory of 2484 2068 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2484
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
888KB
MD5570c8d81d9598a005d5161de45d8c03d
SHA19cf94f481bfb4522cbbabed7eeca803da9d6c63b
SHA256f6bcaac2584d7ceae9564ac94ff2999912e8f7b755c337a7ac2d0b672d3b6ce7
SHA5129d47560e089c4f5cffd1e44adcb06715401be8a207e6d35bd29e4a09b136de66f15dc038839cafa34c495316fb1478e290145f72ae0c64599f4416a2791e5cbc
-
Filesize
183B
MD5c4c77a1d575703f34fdc812cb03a3d85
SHA1ec8d857a9abaf49b8d9f885a1e9fd682e3cdc948
SHA256d29bf559b68b76cbed639f36028b39f5bae2a962f9e9a1a87e69def708d6b538
SHA512fd9a31f646d38eb2b74d0e639f8e706e99b69028e5307fa591414ce32098fcfe836b7afedaf94dcc76a794cf808440f90a1d443891814628ad0c31e859217fdf