Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/04/2024, 19:01
Behavioral task
behavioral1
Sample
1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe
Resource
win10v2004-20240226-en
General
-
Target
1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe
-
Size
342KB
-
MD5
4872e250d951de9ac7a051824be7d500
-
SHA1
4722437fbb8e4669d4b13333d762020e14a6c46f
-
SHA256
1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a
-
SHA512
425ce2c02af68e3845c80c2ae7b9f29d5c438824742f180523803f7512d43aa4a3d9c3cedddd8d7d4d277d688eb6dd1dc43e38464feac42aefed655ee74d7458
-
SSDEEP
6144:JjluyDM3Io5R4nM/40yJNvpIG4bPyylZZewFZ4gJHshCPhio2JDEq3K4kIsuBc:JEyDMhqhtpn4bqylZnF9JHQq52K4kR3
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 17 IoCs
resource yara_rule behavioral1/memory/2164-87-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1160-88-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2372-89-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2164-90-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2164-92-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2164-96-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2164-109-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2164-112-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2164-115-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2164-118-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2164-121-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2164-126-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2164-129-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2164-132-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2164-135-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2164-138-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2164-141-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 22 IoCs
resource yara_rule behavioral1/memory/2164-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/files/0x00070000000141fe-5.dat UPX behavioral1/memory/1160-11-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1160-53-0x0000000004900000-0x000000000491E000-memory.dmp UPX behavioral1/memory/2164-87-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1160-88-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2372-89-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2164-90-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2164-91-0x0000000004DB0000-0x0000000004DCE000-memory.dmp UPX behavioral1/memory/2164-92-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2164-96-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2164-109-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2164-112-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2164-115-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2164-118-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2164-121-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2164-126-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2164-129-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2164-132-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2164-135-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2164-138-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2164-141-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2164-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/files/0x00070000000141fe-5.dat upx behavioral1/memory/1160-11-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1160-53-0x0000000004900000-0x000000000491E000-memory.dmp upx behavioral1/memory/2164-87-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1160-88-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2372-89-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2164-90-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2164-91-0x0000000004DB0000-0x0000000004DCE000-memory.dmp upx behavioral1/memory/2164-92-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2164-96-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2164-109-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2164-112-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2164-115-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2164-118-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2164-121-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2164-126-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2164-129-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2164-132-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2164-135-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2164-138-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2164-141-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\L: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\U: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\V: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\W: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\E: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\G: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\I: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\Y: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\Q: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\X: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\K: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\N: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\O: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\S: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\M: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\P: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\R: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\T: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\Z: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\A: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\B: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File opened (read-only) \??\H: 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lingerie public redhair .rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\SysWOW64\IME\shared\bukkake catfight penetration (Kathrin,Karin).avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian handjob lesbian uncut shoes .avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\SysWOW64\IME\shared\italian kicking beast full movie black hairunshaved .zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\SysWOW64\config\systemprofile\gay voyeur Ôë .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\System32\DriverStore\Temp\russian horse xxx lesbian circumcision (Jenna,Janette).zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\SysWOW64\FxsTmp\cumshot fucking masturbation leather .mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\swedish action blowjob [bangbus] latex .rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\SysWOW64\config\systemprofile\sperm several models hairy (Sandy,Jade).rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\SysWOW64\FxsTmp\american action lingerie several models cock gorgeoushorny (Sarah).rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\microsoft shared\brasilian nude fucking [milf] hole .mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Program Files (x86)\Google\Temp\american cumshot trambling big mature .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\swedish beastiality lesbian licking bondage (Anniston,Tatjana).mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\danish kicking bukkake masturbation penetration .avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Program Files\DVD Maker\Shared\japanese beastiality fucking lesbian titts (Jenna,Curtney).zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Program Files (x86)\Google\Update\Download\indian fetish horse hidden titts .rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\brasilian cum horse voyeur .mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Program Files\Common Files\Microsoft Shared\sperm [free] cock leather .avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\gay voyeur lady .avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Program Files\Windows Journal\Templates\black cumshot fucking public cock bedroom (Melissa).rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\indian gang bang hardcore [bangbus] penetration .zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\tyrkish cum bukkake uncut .rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\black cum lingerie girls glans leather .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Program Files (x86)\Microsoft Office\Templates\xxx big glans .mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\danish action bukkake sleeping glans .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\chinese hardcore several models hole upskirt (Melissa).zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\beastiality hardcore sleeping hole .zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\black action sperm voyeur titts sm (Sylvia).zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\swedish handjob blowjob [milf] (Sylvia).rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\norwegian sperm hidden ejaculation .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\black handjob lesbian girls mature .rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\black nude sperm sleeping (Tatjana).mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\handjob xxx big titts .zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\american action horse hot (!) ash .zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\Downloaded Program Files\russian cumshot sperm hot (!) hole wifey (Samantha).avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\danish cum hardcore full movie penetration .zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\chinese hardcore hidden cock beautyfull .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\chinese lingerie public boots .avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\american nude beast big cock gorgeoushorny .mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\assembly\temp\tyrkish handjob lesbian public .zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\nude sperm uncut glans granny .zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\spanish bukkake catfight hole gorgeoushorny .rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\brasilian action xxx catfight .mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\lesbian full movie hairy .mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\swedish kicking gay hot (!) .avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\InstallTemp\fetish xxx [milf] .rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\horse xxx public titts .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\lesbian uncut (Sarah).mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\japanese animal hardcore [bangbus] circumcision .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\danish horse blowjob voyeur cock .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\beast public 50+ .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\fucking lesbian 40+ (Gina,Karin).mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\indian porn fucking hidden titts balls .mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\norwegian fucking several models cock sweet (Samantha).zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\security\templates\russian cum trambling catfight redhair .rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\spanish sperm catfight bedroom .avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\mssrv.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\hardcore voyeur hotel .avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\malaysia fucking full movie blondie .mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\brasilian nude sperm licking pregnant (Sonja,Janette).mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\malaysia sperm full movie (Tatjana).mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\assembly\tmp\indian porn lesbian several models (Karin).mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\xxx girls titts .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\indian horse hardcore masturbation shoes .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian cum beast voyeur hole bedroom .rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\blowjob big glans granny (Karin).avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\trambling [free] blondie .avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\horse hidden .mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\asian blowjob [bangbus] cock high heels .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\russian cumshot gay several models (Liz).rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\gay hidden hole .avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\beastiality fucking masturbation .rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\xxx voyeur mistress .rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\malaysia bukkake public castration (Britney,Jade).avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\lingerie sleeping penetration .rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\gang bang lingerie lesbian shower .avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\brasilian animal lingerie public (Liz).mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\malaysia beast [bangbus] titts swallow (Jade).mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\american nude sperm catfight glans boots .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\russian cumshot hardcore [bangbus] young .avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\horse hidden .zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\indian horse blowjob full movie .avi.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\british beast hot (!) feet bedroom (Melissa).mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\german sperm masturbation penetration .zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\russian action gay full movie glans traffic .zip.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\xxx [free] bondage .mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\xxx big feet hairy .rar.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\cum sperm hidden granny .mpg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\cumshot sperm full movie (Liz).mpeg.exe 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2372 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2164 wrote to memory of 1160 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 28 PID 2164 wrote to memory of 1160 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 28 PID 2164 wrote to memory of 1160 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 28 PID 2164 wrote to memory of 1160 2164 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 28 PID 1160 wrote to memory of 2372 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 29 PID 1160 wrote to memory of 2372 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 29 PID 1160 wrote to memory of 2372 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 29 PID 1160 wrote to memory of 2372 1160 1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe"C:\Users\Admin\AppData\Local\Temp\1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe"C:\Users\Admin\AppData\Local\Temp\1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe"C:\Users\Admin\AppData\Local\Temp\1804540d1670d8d4c8a1ff4055cc25612e83bd25034d92501674cb6530b6f84a.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2372
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5c52377a8b5366f4caaca6de524fb8899
SHA1a8d7b86cce2060174f800022013ac58cfb96f7dc
SHA25660b656bfb97f5e64e4092868742bf36bf71713e543512a2aadda2fc8e54e6d02
SHA512fd3ff9c3e70a95d7764d10a0dc197b07dd1d502161323d99e0135844a532cef2954729dc1b65bdcd8415e02f9ff4e86cb09d140757a247a7a782bf3e4034816a