Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/04/2024, 19:05
Behavioral task
behavioral1
Sample
1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe
Resource
win10v2004-20240226-en
General
-
Target
1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe
-
Size
332KB
-
MD5
2c7509903bc0eade4f46babbfccb21f2
-
SHA1
7085ca3f6ee7b953f01259586e9b900b42e4cdd0
-
SHA256
1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b
-
SHA512
6680b60a2ee0e8363c4b76426bc2b332eb7b377ffd701ad3262b75f06d024b6c634e8587dd75a5fae1aeefb17d8bf0a72977ce1f90e02c4e33d13c90066af29a
-
SSDEEP
6144:bjluQoSsqaxIo5R4nM/Thz5bdboSK9OHAl5SjRfraLPhPRgqllyTPCYwjKpFGyNS:bEQoSx0q2ZfKsgLS9frghGqjyTPojKPQ
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 2 IoCs
resource yara_rule behavioral1/memory/2400-58-0x0000000000400000-0x0000000000429000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2612-90-0x0000000000400000-0x0000000000429000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/2044-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x00070000000164b2-5.dat UPX behavioral1/memory/2400-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2612-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2044-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x00070000000164b2-5.dat upx behavioral1/memory/2400-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-90-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\K: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\L: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\P: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\R: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\Z: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\B: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\H: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\O: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\S: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\T: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\X: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\A: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\E: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\J: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\M: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\Q: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\U: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\Y: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\G: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\N: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\V: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\W: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\russian cum lesbian hidden (Sarah).mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\blowjob lesbian YEâPSè& (Ashley,Tatjana).mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\IME\shared\brasilian animal hardcore uncut .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\FxsTmp\black porn gay hot (!) granny .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\IME\shared\trambling [bangbus] leather .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\System32\DriverStore\Temp\cum fucking [milf] hole upskirt (Tatjana).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\FxsTmp\nude gay [bangbus] .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\hardcore [milf] feet latex .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\config\systemprofile\danish animal lesbian public hole .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lesbian voyeur glans .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Windows Journal\Templates\gay several models cock redhair (Liz).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Common Files\microsoft shared\gay catfight (Sylvia).mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\beast uncut feet sweet (Samantha).mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\swedish animal fucking big redhair .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\beast catfight (Curtney).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\japanese kicking trambling girls sm .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Microsoft Office\Templates\horse big blondie (Sonja,Liz).avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\fucking [milf] wifey .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files\Common Files\Microsoft Shared\lesbian several models titts (Britney,Sarah).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files\DVD Maker\Shared\black gang bang horse several models hole .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Google\Temp\hardcore sleeping lady (Britney,Samantha).mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Google\Update\Download\russian cum lesbian full movie (Janette).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\italian kicking xxx sleeping redhair .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\brasilian animal bukkake catfight sm .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\danish gang bang gay big feet .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\british horse lesbian feet (Gina,Liz).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\african blowjob hidden .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\norwegian sperm masturbation hole fishy .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\british xxx hot (!) feet .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\beastiality blowjob uncut titts latex (Janette).avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\sperm several models leather .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\bukkake sleeping .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\gay voyeur (Karin).mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\chinese beast masturbation glans circumcision .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\beastiality hardcore big glans high heels .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\norwegian lesbian big bedroom .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\canadian horse [free] hole leather .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\tyrkish cumshot fucking sleeping (Sarah).rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\malaysia lesbian public cock traffic .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\norwegian beast public cock .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\british blowjob public (Sarah).mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\canadian hardcore licking shower .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\tyrkish cumshot hardcore uncut glans latex .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\russian handjob sperm catfight .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\danish cum sperm hot (!) titts fishy (Melissa).mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\chinese beast licking cock stockings .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\beastiality fucking hot (!) titts gorgeoushorny .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\british sperm licking balls .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\american action trambling [bangbus] .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\canadian hardcore full movie feet young .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\german beast public 50+ .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\action gay uncut high heels .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\tyrkish handjob sperm catfight glans .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\african xxx [milf] blondie .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\kicking horse [free] cock fishy (Liz).avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\danish cum trambling girls (Melissa).avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\mssrv.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\danish horse fucking [free] feet granny .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\malaysia hardcore [free] hole redhair .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\bukkake public .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\black cum lesbian catfight lady .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\cumshot fucking [milf] cock .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\beast hot (!) feet lady .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\malaysia blowjob several models hole bedroom .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\swedish nude xxx several models (Samantha).mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\Temp\bukkake masturbation feet .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\beast hidden hole .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\french hardcore lesbian (Jade).avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\african bukkake hot (!) cock beautyfull (Samantha).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\swedish gang bang hardcore big bedroom .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\african fucking sleeping .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\chinese horse lesbian titts .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\japanese horse trambling big feet .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\tyrkish cum bukkake hot (!) feet latex .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SoftwareDistribution\Download\brasilian horse beast [bangbus] .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\chinese lingerie masturbation hole penetration (Liz).avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\asian gay [milf] stockings .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\indian action trambling several models glans .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\InstallTemp\beastiality horse big glans .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\gay public glans (Christine,Samantha).avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\black kicking gay [free] cock (Jenna,Curtney).mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\security\templates\brasilian animal xxx several models feet circumcision .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\african horse uncut hole .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\brasilian beastiality beast hot (!) feet .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\sperm big pregnant .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\russian horse xxx uncut .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\indian gang bang beast masturbation beautyfull (Kathrin,Melissa).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\Downloaded Program Files\xxx hidden glans YEâPSè& (Liz).rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\animal gay sleeping .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 2612 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2044 wrote to memory of 2400 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 28 PID 2044 wrote to memory of 2400 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 28 PID 2044 wrote to memory of 2400 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 28 PID 2044 wrote to memory of 2400 2044 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 28 PID 2400 wrote to memory of 2612 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 29 PID 2400 wrote to memory of 2612 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 29 PID 2400 wrote to memory of 2612 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 29 PID 2400 wrote to memory of 2612 2400 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe"C:\Users\Admin\AppData\Local\Temp\1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe"C:\Users\Admin\AppData\Local\Temp\1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe"C:\Users\Admin\AppData\Local\Temp\1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2612
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1017KB
MD59bce52e7018b771c2ec31500dd2ca931
SHA11027a7a3252910f3d74c300b987abe1880ab2c0f
SHA256917dc1f8316e14f3cda2463ffc4e511f9e184b39350c277a7906a5eab9eacc56
SHA512477d5bce98d16f183e71a2587693d4f6699e2446c581bba19145a0495f56278af644a7df76591addc307d21554db2416ec0bd5cb0f3b09eae5e6ab1a2d42f8cf
-
Filesize
183B
MD5c97782175e47a95d06fb869b454509fc
SHA1bba54e6cec2d0dc0c7a04681d44909c7a36002f7
SHA256259d4f047b29e70822150651a2a52de83ef6b0dbd1661cb7177769844f0e8bcd
SHA512a79b3dcdd5a0c2c39067bcac09021e0295a3fa03616c9f11b2f192fc4f5f197d3e44f8b1c5e8a7f7c57c9523ffff00a1aa28dd022d7177e51923614036501322