Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 19:20
Behavioral task
behavioral1
Sample
223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe
Resource
win10v2004-20240226-en
General
-
Target
223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe
-
Size
2.0MB
-
MD5
4e5872eca08a9d04742b50d9f860b3e5
-
SHA1
0d223ce9bd58ab906e8083e4facd496cb0601eeb
-
SHA256
223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd
-
SHA512
6306c8ed138e017af0558b766a6bc9f33af75d67c001f8eb1bc1c19a52efa3aa60a5d7a2fa11bd1e3b8de432192f0cc5ba32a76d7492ca2dd3f2881c5810bef9
-
SSDEEP
49152:j6GIJg7d1hmD9gWwEe5Afsak2DW4ZEkczOtsDkFYta:j6LJUdnhJ5jai4bcyt/+k
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2516-78-0x0000000000400000-0x0000000000429000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2904-88-0x0000000000400000-0x0000000000429000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 4 IoCs
Processes:
resource yara_rule behavioral1/memory/836-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\Program Files\Windows Sidebar\Shared Gadgets\lingerie [free] wifey .zip.exe UPX behavioral1/memory/2516-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2904-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/836-0-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\Program Files\Windows Sidebar\Shared Gadgets\lingerie [free] wifey .zip.exe upx behavioral1/memory/2516-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-88-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exedescription ioc process File opened (read-only) \??\A: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\G: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\L: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\R: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\Y: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\I: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\O: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\V: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\W: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\S: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\U: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\X: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\Z: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\B: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\M: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\P: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\Q: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\N: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\T: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\E: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\H: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\J: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File opened (read-only) \??\K: 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe -
Drops file in System32 directory 10 IoCs
Processes:
223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\japanese cumshot blowjob several models pregnant (Sonja,Sarah).rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian cumshot beast [free] (Melissa).mpg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\SysWOW64\IME\shared\tyrkish fetish horse full movie castration .avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\SysWOW64\config\systemprofile\tyrkish animal fucking public 50+ .rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\System32\DriverStore\Temp\beast big sweet .rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\SysWOW64\FxsTmp\hardcore hidden (Janette).mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\beast sleeping sm (Sandy,Sarah).zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\japanese gang bang blowjob full movie (Jade).avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\SysWOW64\FxsTmp\beast hot (!) glans bondage (Sarah).zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\SysWOW64\IME\shared\brasilian cumshot trambling lesbian .zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe -
Drops file in Program Files directory 15 IoCs
Processes:
223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exedescription ioc process File created C:\Program Files\DVD Maker\Shared\swedish beastiality lesbian uncut .mpg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Program Files (x86)\Google\Update\Download\danish gang bang horse [bangbus] (Tatjana).mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\sperm full movie glans (Gina,Curtney).mpg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\lingerie [free] wifey .zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\american gang bang sperm full movie redhair .avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Program Files (x86)\Common Files\microsoft shared\fucking several models redhair .mpg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Program Files (x86)\Microsoft Office\Templates\american nude fucking [milf] .mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\brasilian porn trambling hidden 50+ .mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\black kicking blowjob licking traffic .avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\hardcore licking beautyfull .zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Program Files\Common Files\Microsoft Shared\lesbian licking shoes (Gina,Janette).mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Program Files\Windows Journal\Templates\italian beastiality blowjob lesbian hotel .rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\indian horse fucking [free] hole .mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Program Files (x86)\Google\Temp\japanese animal lingerie masturbation .zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\gay [bangbus] .avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe -
Drops file in Windows directory 64 IoCs
Processes:
223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exedescription ioc process File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\trambling big granny (Sonja,Karin).rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\british lingerie girls titts ash (Melissa).rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\canadian hardcore several models stockings .zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\japanese handjob lesbian sleeping hole sm .avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\brasilian animal blowjob masturbation hotel .avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\british fucking public hole .avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\cum xxx several models cock latex .rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\PLA\Templates\brasilian porn bukkake several models hole (Christine,Liz).mpg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\swedish porn sperm lesbian feet (Jenna,Curtney).rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\malaysia fucking licking cock (Jenna,Tatjana).zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\fucking hot (!) glans wifey .mpg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\beast licking feet upskirt (Melissa).mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\nude gay sleeping .avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\porn xxx voyeur 40+ .rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\hardcore several models latex .avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\fucking [bangbus] traffic (Kathrin,Liz).avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\kicking horse girls .mpg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\british sperm several models feet sweet (Karin).avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\horse blowjob catfight ìï .mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\trambling girls cock .mpg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\horse lesbian .zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\fucking lesbian cock stockings (Curtney).rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\gay masturbation titts .rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\hardcore [milf] feet ejaculation (Curtney).zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\malaysia lesbian full movie fishy (Britney,Tatjana).avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\italian cum beast hot (!) titts fishy .mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\fucking hot (!) cock Ôë (Karin).mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\assembly\tmp\tyrkish beastiality blowjob [milf] (Curtney).rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\hardcore lesbian .rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\german xxx voyeur upskirt (Jenna,Jade).zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\kicking sperm girls hole .rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\black nude gay lesbian YEâPSè& .mpg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\assembly\temp\trambling licking black hairunshaved (Britney,Liz).mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\cumshot trambling hot (!) hole redhair (Liz).mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\african sperm [bangbus] (Tatjana).zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\german trambling uncut (Janette).avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\chinese horse catfight mature .rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\fetish gay lesbian .rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\InstallTemp\horse masturbation black hairunshaved (Sonja,Sylvia).mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\german lingerie sleeping cock shoes .mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\brasilian animal xxx [milf] .zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\security\templates\japanese cumshot bukkake hidden hole .zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\nude fucking [bangbus] redhair .zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\american cum hardcore hot (!) glans .mpg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\danish animal xxx masturbation glans boots .mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\lesbian uncut cock .rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\trambling catfight feet ash .avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\asian horse catfight titts ejaculation .zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\chinese xxx girls feet balls .zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish animal hardcore [bangbus] gorgeoushorny .mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\chinese trambling hidden beautyfull .rar.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\SoftwareDistribution\Download\japanese cumshot blowjob catfight (Tatjana).avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\sperm full movie hole (Jenna,Samantha).zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\tyrkish cumshot lesbian licking .mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\kicking lesbian masturbation blondie .avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\danish handjob sperm big cock circumcision (Tatjana).mpg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\swedish cum horse uncut lady .avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\animal lingerie catfight (Sarah).mpg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\hardcore sleeping shoes (Anniston,Sarah).mpeg.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\canadian sperm [milf] cock redhair .avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\fucking hot (!) glans blondie .zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\porn hardcore voyeur hole .zip.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\tyrkish fetish beast lesbian cock (Jenna,Jade).avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\beast girls .avi.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exepid process 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 2904 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exedescription pid process target process PID 836 wrote to memory of 2516 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe PID 836 wrote to memory of 2516 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe PID 836 wrote to memory of 2516 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe PID 836 wrote to memory of 2516 836 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe PID 2516 wrote to memory of 2904 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe PID 2516 wrote to memory of 2904 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe PID 2516 wrote to memory of 2904 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe PID 2516 wrote to memory of 2904 2516 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe 223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe"C:\Users\Admin\AppData\Local\Temp\223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe"C:\Users\Admin\AppData\Local\Temp\223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe"C:\Users\Admin\AppData\Local\Temp\223114c4b6125f7f36b292d1048b3827941b6e970aa32466999cd6078ad45bbd.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2904
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
871KB
MD54ab761d5e57ed38d44c6041f0127e58e
SHA18e1fbe6d54bd32d52c4633cb534bdff5eedf5058
SHA2564fe9220b5ac9b953e54adf91dd54476c68bd21a43e1853619ef0d9f31d7fafe5
SHA51257eedfadfab19014760336afa920aa4080b984bcc3c1e3fa5ec77741ca1e65bb54f167f1e4c95c99f3e7fa5742ab4e05d4f8bfe4c258ab08c76f40212e46fa83