Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/04/2024, 19:06
Behavioral task
behavioral1
Sample
1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe
Resource
win10v2004-20240226-en
General
-
Target
1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe
-
Size
372KB
-
MD5
350c6c97a34f7893e06c9f48b673488c
-
SHA1
3b0a97b004070bc78b877b6fd0400660599fb429
-
SHA256
1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09
-
SHA512
7222f00528ec07c9c16825f500b4ec3fe5562ed11d98400666ff4455db6ad8fecddb650ae1ee476ee5f69fe6aea7a0a99a6a1a4803de6cc909884eff6cb93f76
-
SSDEEP
6144:JjluyDM3Io5R4nM/40yJNkzj7pX2ZKjC2mzvXfbdyrE+NxRTv8lDWyIqiNlB4Rke:JEyDMhqhibpDC2mjXfZ+N3wpiNlCknI
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 19 IoCs
resource yara_rule behavioral1/memory/2752-54-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1300-87-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-89-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2752-92-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1300-101-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-103-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-102-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-108-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-111-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-114-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-119-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-122-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-125-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-128-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-131-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-134-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-137-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-140-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-143-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 21 IoCs
resource yara_rule behavioral1/memory/2228-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/files/0x0007000000015653-5.dat UPX behavioral1/memory/2752-54-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1300-87-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-89-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2752-92-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1300-101-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-103-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-102-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-108-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-111-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-114-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-119-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-122-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-125-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-128-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-131-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-134-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-137-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-140-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2228-143-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2228-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/files/0x0007000000015653-5.dat upx behavioral1/memory/2752-54-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1300-87-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-89-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2752-92-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1300-101-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-103-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-102-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-108-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-111-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-114-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-119-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-122-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-125-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-128-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-131-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-134-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-137-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-140-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2228-143-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\G: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\H: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\I: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\J: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\Q: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\R: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\T: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\X: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\Z: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\V: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\Y: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\K: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\S: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\U: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\W: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\B: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\E: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\L: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\M: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\N: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\O: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\P: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\norwegian cum hot (!) swallow .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\FxsTmp\fetish porn girls feet latex (Anniston,Tatjana).avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\malaysia trambling lingerie full movie (Gina).mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\FxsTmp\norwegian bukkake horse voyeur 40+ .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\IME\shared\bukkake beast catfight nipples (Ashley).mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\config\systemprofile\horse voyeur high heels .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\System32\DriverStore\Temp\malaysia cumshot masturbation traffic .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\IME\shared\beastiality several models nipples young (Britney,Sonja).mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\tyrkish cumshot hidden ash .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\config\systemprofile\lesbian [milf] YEâPSè& .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\tyrkish hardcore lesbian lesbian titts 50+ .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files\Windows Journal\Templates\gay [free] upskirt .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Common Files\microsoft shared\trambling big .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\action licking traffic .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files\DVD Maker\Shared\cumshot horse catfight .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Google\Update\Download\canadian bukkake bukkake lesbian hole YEâPSè& .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\asian fetish big boots .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\french kicking [free] sm (Sandy).zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\french kicking hidden mature .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\african cumshot voyeur .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\indian action beastiality public .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\chinese gang bang hot (!) lady .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\malaysia horse [bangbus] young .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Google\Temp\sperm gang bang [bangbus] nipples .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Microsoft Office\Templates\indian porn licking legs boots .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\italian fetish lesbian catfight castration (Melissa).avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\beast porn [bangbus] blondie (Janette).avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\fucking uncut swallow (Jenna).rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\horse sperm full movie .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\action public 50+ .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\chinese blowjob xxx catfight .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\assembly\temp\indian fucking trambling [free] feet fishy .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SoftwareDistribution\Download\horse public .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\african gang bang public hole .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\bukkake uncut (Janette,Anniston).mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\british nude several models castration .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\horse full movie nipples 50+ .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\cumshot licking hairy .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\fetish [free] cock gorgeoushorny .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\cum fucking licking .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\gang bang gay [bangbus] feet YEâPSè& .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\gang bang lingerie catfight ìï (Kathrin,Sonja).mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\british gay gay hidden (Britney,Kathrin).zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\sperm xxx hidden titts fishy (Sonja,Curtney).zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\hardcore girls .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\handjob big feet castration (Gina,Sonja).mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\kicking licking .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\horse [free] vagina .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\canadian beastiality [bangbus] sm .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\sperm horse catfight blondie .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\danish horse hardcore hidden legs (Sandy).mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\swedish horse gay [bangbus] .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\indian trambling animal voyeur cock castration .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\nude [milf] vagina ejaculation (Sylvia,Gina).mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\italian animal cumshot masturbation shoes (Karin).rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\lingerie animal hidden leather (Tatjana).mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\bukkake [milf] .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\italian kicking licking redhair .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\british gang bang nude [milf] (Britney).mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\InstallTemp\american kicking several models ash .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\gay [bangbus] YEâPSè& (Melissa,Jenna).mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\japanese horse lesbian black hairunshaved .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\asian gay beast hidden 40+ .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\russian cumshot porn public ìï .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\hardcore girls wifey .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\malaysia cum handjob [bangbus] femdom .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\handjob nude hot (!) beautyfull .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\PLA\Templates\nude masturbation bedroom .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\malaysia xxx sperm uncut hotel .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\lesbian horse hot (!) beautyfull .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\german action nude [milf] YEâPSè& .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\assembly\tmp\british bukkake lesbian titts .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\norwegian cum hot (!) legs .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\fucking [bangbus] legs (Jade).mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\british blowjob [free] bondage .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\japanese xxx action several models .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\german bukkake cumshot hidden .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\japanese action voyeur .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\french xxx porn licking cock Ôë .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\russian nude xxx girls beautyfull .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\french horse lingerie girls redhair (Sonja,Sylvia).zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\african lingerie lingerie full movie .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\american blowjob sleeping hairy (Anniston).zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\german animal uncut boobs ash .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\trambling nude girls (Liz,Liz).zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\norwegian sperm animal public high heels .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\animal hardcore [free] .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\handjob uncut pregnant .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\danish gang bang girls .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1300 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2752 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 28 PID 2228 wrote to memory of 2752 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 28 PID 2228 wrote to memory of 2752 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 28 PID 2228 wrote to memory of 2752 2228 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 28 PID 2752 wrote to memory of 1300 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 29 PID 2752 wrote to memory of 1300 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 29 PID 2752 wrote to memory of 1300 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 29 PID 2752 wrote to memory of 1300 2752 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe"C:\Users\Admin\AppData\Local\Temp\1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe"C:\Users\Admin\AppData\Local\Temp\1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe"C:\Users\Admin\AppData\Local\Temp\1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5d6edfcf7e4bfa498161bd32b16027e65
SHA1c48e98774389ae1453e5bece4b39dc24aabdeec5
SHA2565ae0089b15b8a4cde6fe0493323dff4f2afff798ad575d8231768c3910a5368f
SHA51251b29ccd2fc705b6625a515656d3d18c56f1259474a0e4c92b89eb757a11696b6220a0f90a14e01c5c355098020642409a6f635170f7b32631288b12e759e061
-
Filesize
183B
MD53b08522a3c3206c4a4311b1e1776dc8b
SHA16115352ae8d47c0e665f16ff9d1423e7a71d9a91
SHA25622accc3aa9270023e691cd400c10e6269546600f9cb3b1332ed2f8e252581570
SHA5124ec4c168d352532ba4708f20a03539dc655d76a418d51e4416af8d988b2d01641fd78823f67d919c2fb89228d0e25b6e802975288e08967388354cdc926c655f