Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 19:25
Static task
static1
Behavioral task
behavioral1
Sample
249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe
Resource
win10v2004-20240226-en
General
-
Target
249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe
-
Size
421KB
-
MD5
852f077198266076a6e52bddea5ea723
-
SHA1
47f1274992104496c364db32b44cb44ffcee7f76
-
SHA256
249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1
-
SHA512
57895b94fa5a0ef2357116d64d0d2e9dace30522033f516abbfc1f0a7983fcf260623de013c87d8878d9b14c63c7a5227ae040aa753fa6ddb01c0074534902a9
-
SSDEEP
6144:dXC4vgmhbIxs3NBRZZHhXJvDEclCpU/NoBkCWTFnd61OjPqKEuKBor2OZuQ0NRcc:dXCNi9B9vAoNhCDkjiioXeu1NBdnDr
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
Processes:
resource yara_rule C:\Program Files\Windows Sidebar\Shared Gadgets\asian fucking xxx public balls .avi.exe INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exedescription ioc process File opened (read-only) \??\U: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\H: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\J: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\K: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\M: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\R: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\B: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\G: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\I: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\O: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\Z: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\N: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\S: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\T: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\V: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\W: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\X: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\Y: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\A: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\E: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\L: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\P: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File opened (read-only) \??\Q: 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe -
Drops file in System32 directory 10 IoCs
Processes:
249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\american lesbian lesbian latex .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\System32\DriverStore\Temp\nude blowjob voyeur redhair .avi.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\SysWOW64\FxsTmp\fetish hardcore [bangbus] .rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\cumshot hot (!) sweet .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\SysWOW64\FxsTmp\chinese kicking hot (!) (Anniston).rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\SysWOW64\IME\shared\canadian cumshot xxx [milf] (Gina,Janette).mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lesbian nude public .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\SysWOW64\IME\shared\hardcore [milf] .avi.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\british kicking girls ash high heels .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\SysWOW64\config\systemprofile\african gay action hot (!) glans hairy .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe -
Drops file in Program Files directory 15 IoCs
Processes:
249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\chinese action cumshot lesbian fishy (Ashley).mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\asian fucking xxx public balls .avi.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\brasilian porn [bangbus] glans .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\norwegian horse licking ¤ã .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Program Files (x86)\Google\Temp\asian nude masturbation .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Program Files (x86)\Google\Update\Download\danish lingerie kicking uncut vagina .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\porn public redhair .avi.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\cumshot full movie (Karin,Janette).zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Program Files\Windows Journal\Templates\fucking xxx girls .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\brasilian horse blowjob hidden glans 40+ .rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\chinese fetish action sleeping cock .mpeg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Program Files\DVD Maker\Shared\blowjob handjob hidden ash swallow (Kathrin).mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Program Files (x86)\Microsoft Office\Templates\tyrkish beastiality licking hole .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\swedish beast porn public (Kathrin,Sonja).mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\horse [free] ash .rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe -
Drops file in Windows directory 64 IoCs
Processes:
249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exedescription ioc process File created C:\Windows\assembly\temp\italian porn cum catfight circumcision .avi.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\bukkake porn hidden hotel .rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\trambling public gorgeoushorny .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\gay porn [free] castration .avi.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\british gay [free] feet upskirt .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\brasilian sperm lesbian penetration .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\fetish xxx hot (!) cock mistress .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\beast lesbian castration .mpeg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\Downloaded Program Files\chinese trambling [free] .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\gang bang public .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\tyrkish sperm masturbation 50+ .avi.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\italian blowjob licking feet ìï .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\cum [bangbus] penetration .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\beastiality licking .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\african handjob horse sleeping circumcision (Christine).zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\tyrkish bukkake licking black hairunshaved .mpeg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\xxx uncut legs .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\tyrkish action beast public glans ash (Tatjana,Karin).avi.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\blowjob [free] (Curtney).rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\chinese gang bang gay catfight stockings .rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\chinese blowjob girls hole boots (Sonja,Sylvia).mpeg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\tyrkish beast beastiality [free] sm (Janette).zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\danish cumshot porn public 40+ .rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\chinese handjob licking .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\gay horse [milf] redhair .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\fetish sleeping vagina .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\japanese nude several models shower (Anniston,Tatjana).mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\trambling uncut glans bedroom .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\danish horse nude hot (!) mature (Jenna,Christine).avi.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\brasilian lingerie bukkake sleeping .rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\indian handjob blowjob [bangbus] beautyfull .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\tyrkish hardcore public titts .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\malaysia horse licking ash traffic (Liz,Tatjana).mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\italian cum girls nipples gorgeoushorny .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\kicking big (Samantha,Sylvia).zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\Temp\cum beastiality sleeping black hairunshaved .mpeg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\SoftwareDistribution\Download\cum sleeping ash .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\horse beastiality catfight .mpeg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\swedish trambling hot (!) bedroom .mpeg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\russian beastiality hot (!) lady (Jenna,Anniston).zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\cumshot cum public (Jade,Curtney).mpeg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\sperm several models cock redhair .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\british cumshot [free] glans (Sylvia,Sarah).zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\blowjob lesbian [bangbus] .mpeg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\blowjob gay hidden .mpeg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\xxx [bangbus] balls .mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\mssrv.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\blowjob horse uncut boobs bedroom .rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\xxx licking 50+ .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\assembly\tmp\french trambling uncut traffic (Sylvia,Christine).mpg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\PLA\Templates\nude uncut mistress .rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\tyrkish horse gang bang big circumcision .avi.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\blowjob handjob full movie pregnant .avi.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\swedish trambling action sleeping nipples (Liz,Liz).avi.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\german hardcore hot (!) (Sonja).rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\beastiality horse catfight ash .rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\horse uncut young .avi.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\horse full movie glans hotel .mpeg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\fetish licking vagina girly (Anniston).avi.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\xxx uncut .rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\handjob handjob hot (!) (Christine,Christine).mpeg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\sperm uncut hole .rar.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\german porn sperm full movie mistress .mpeg.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\african xxx lesbian ash .zip.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exepid process 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 1820 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exedescription pid process target process PID 1460 wrote to memory of 2796 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe PID 1460 wrote to memory of 2796 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe PID 1460 wrote to memory of 2796 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe PID 1460 wrote to memory of 2796 1460 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe PID 2796 wrote to memory of 1820 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe PID 2796 wrote to memory of 1820 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe PID 2796 wrote to memory of 1820 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe PID 2796 wrote to memory of 1820 2796 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe 249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe"C:\Users\Admin\AppData\Local\Temp\249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe"C:\Users\Admin\AppData\Local\Temp\249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe"C:\Users\Admin\AppData\Local\Temp\249db0644c747dd9bd92e002e70519e61fc72fd9b37b882fb70461838dfe04c1.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5741d1d9099dc8c36202dd3b5e1308cbd
SHA105a9ffac1021738bfcc8f8c2bd09342153e71512
SHA2566ed8a3827a67faa95c2fde09b845fa71f2a353c3ac1e2efdc7cabb0980d1ce12
SHA512d1a686ea1f72bbcc4d331761be633233a7a1a942d4d596b9b7fa95e9d52e892b6804906d3a203a03d7a7913b0d05c546f835bad5e025a23a4250cc88e96505d6
-
Filesize
183B
MD5fc1b25acc90daa65f01e4e08a3e07b22
SHA107398d8339c9fa169ef3edbeb68d7d40fa88f791
SHA256c2a29a6be316e922d24821946cb312f7e8c9f32993c4b8be3ef256f7880a6ab7
SHA5124424fd956e969c485efba3175f38e8f4b1ac94c7a913bc302ba073e8de471c978f95c3c8e35c270de9f89a6c609565e45130574ad78f62ba2c2f85a38def5e0f