Analysis
- max time kernel
150s - max time network
149s - platform
windows7_x64 - resource
win7-20240215-en - resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system - submitted
07/04/2024, 19:08
Behavioral task
behavioral1
Sample
1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe
Resource
win7-20240215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe
- Size 1.7MB
- Sample240407-xtbc1sbg8x
- SHA256 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5
- MD5 e4bf0ffb4909f27af806424b59283a1a
- SHA1 4f96d9d2cf71f63d60e09a6c0a4469eeafef3664
- SHA512 552bff9516d0816866e246cc40658a3b7ee361af85084d57913108f43a92ff0f8d33cd090482f8763251e16f405f8e52b1b3f14d0834339f4bd9283d0a936a81
- SSDEEP 24576:V/UoQxYCdY0DUbl/fK8bNOAcDj+gs4DCZrSZuBcA80BSEFsZfu0LSTasrhuzbUrM:OXJXQ/DbNOvBZYUp+TaieuN2/M0p99NP
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Detects executables containing possible sandbox analysis VM usernames 17 IoCs
resource yara_rule behavioral1/memory/2440-67-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/340-88-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-92-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/340-102-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-103-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-108-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-111-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-114-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-119-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-122-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-125-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-128-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-131-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-134-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-137-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-140-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1888-143-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames - UPX dump on OEP (original entry point) 19 IoCs
resource yara_rule behavioral1/memory/1888-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/files/0x0007000000015fa7-5.dat UPX behavioral1/memory/2440-67-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/340-88-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1888-92-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/340-102-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1888-103-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1888-108-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1888-111-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1888-114-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1888-119-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1888-122-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1888-125-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1888-128-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1888-131-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1888-134-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1888-137-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1888-140-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1888-143-0x0000000000400000-0x000000000041E000-memory.dmp UPX - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1888-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/files/0x0007000000015fa7-5.dat upx behavioral1/memory/2440-67-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/340-88-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1888-92-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/340-102-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1888-103-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1888-108-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1888-111-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1888-114-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1888-119-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1888-122-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1888-125-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1888-128-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1888-131-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1888-134-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1888-137-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1888-140-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1888-143-0x0000000000400000-0x000000000041E000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\M: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\N: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\U: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\W: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\Y: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\P: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\Q: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\R: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\S: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\V: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\J: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\K: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\L: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\B: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\E: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\G: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\H: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\I: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\O: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\T: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\X: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File opened (read-only) \??\Z: 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe - Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\lingerie [free] wifey .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\SysWOW64\IME\shared\swedish fetish lesbian [free] blondie (Jenna,Melissa).avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\SysWOW64\config\systemprofile\italian horse bukkake several models feet ejaculation (Karin).zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\SysWOW64\FxsTmp\italian action blowjob catfight cock bedroom .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\SysWOW64\IME\shared\black beastiality lesbian [bangbus] YEâPSè& .mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\SysWOW64\config\systemprofile\swedish gang bang sperm [free] cock bedroom .mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\fucking sleeping feet circumcision .mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\SysWOW64\FxsTmp\sperm [free] (Sarah).rar.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\swedish beastiality lesbian big beautyfull .zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian handjob gay licking .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\Shared Gadgets\american beastiality beast uncut hole (Sandy,Curtney).zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\gay [free] hole fishy .mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\trambling masturbation (Sylvia).mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\indian handjob trambling [milf] latex .mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Program Files (x86)\Google\Temp\hardcore masturbation blondie .mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\black action hardcore big feet boots .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\handjob hardcore hidden .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Program Files\Common Files\Microsoft Shared\japanese cum beast lesbian mistress .mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Program Files (x86)\Common Files\microsoft shared\lingerie hidden pregnant (Christine,Curtney).zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\black kicking hardcore masturbation .zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Program Files\DVD Maker\Shared\tyrkish fetish horse hidden wifey .mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Program Files\Windows Journal\Templates\sperm sleeping penetration .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Program Files (x86)\Google\Update\Download\russian nude trambling uncut penetration .zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Program Files (x86)\Microsoft Office\Templates\lingerie public hole sm (Sylvia).avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\american gang bang sperm [free] feet Χ .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\italian horse lesbian catfight leather .mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\indian horse xxx catfight redhair .mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\trambling public glans (Kathrin,Liz).rar.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\brasilian nude hardcore lesbian feet young (Janette).mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\norwegian horse sleeping .zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\beastiality hardcore [bangbus] stockings .mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\american nude sperm hidden sm (Sonja,Sylvia).mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\american nude hardcore [bangbus] (Sylvia).mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\beastiality lingerie masturbation cock .zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\canadian xxx masturbation .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\bukkake masturbation .rar.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\brasilian beastiality bukkake public leather .mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\british lesbian voyeur boots .mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\lingerie full movie glans .mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\blowjob catfight hole .zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\brasilian porn xxx uncut feet (Ashley,Sarah).avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\assembly\tmp\tyrkish animal lingerie big glans castration (Curtney).mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\tyrkish cumshot blowjob lesbian hairy .mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\action lesbian [bangbus] (Janette).zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\beastiality beast masturbation feet blondie (Tatjana).mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\fetish hardcore several models YEâPSè& .mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\InstallTemp\french gay hot (!) penetration .zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\hardcore full movie cock beautyfull (Liz).avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\security\templates\xxx [free] wifey .rar.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\beast uncut hole .zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\porn horse uncut titts hotel .zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\PLA\Templates\japanese cumshot fucking [free] hotel .mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\japanese porn sperm hot (!) hotel (Anniston,Samantha).rar.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\horse voyeur cock castration (Janette).zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\beast big cock .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\indian fetish xxx catfight hairy .mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\swedish cumshot lesbian voyeur femdom .zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\russian nude fucking [free] blondie .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\mssrv.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\gay catfight .rar.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\animal blowjob full movie hole (Sandy,Liz).avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\xxx public stockings .zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\Temp\horse hot (!) glans .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\fetish sperm [milf] (Tatjana).rar.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\danish beastiality lingerie girls glans 50+ .zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\animal xxx [free] glans pregnant .mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\american animal lesbian sleeping leather (Britney,Tatjana).avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\danish cumshot lingerie masturbation black hairunshaved .rar.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\african bukkake lesbian titts .zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\chinese hardcore hidden feet .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\canadian bukkake full movie .rar.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\handjob horse big ìï .mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\action lesbian hot (!) (Sarah).mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\brasilian fetish horse girls titts .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\lingerie lesbian pregnant (Sandy,Janette).avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\hardcore [milf] (Karin).zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\sperm public sm .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\canadian fucking [free] glans girly (Samantha).zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\american fetish fucking full movie feet .mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\french xxx masturbation blondie .zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\french blowjob sleeping .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\cumshot beast [free] .mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\trambling voyeur (Jade).rar.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\norwegian gay several models ejaculation .rar.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\german lingerie licking (Karin).rar.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\norwegian fucking [bangbus] .avi.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\lesbian big bedroom .mpg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\asian trambling lesbian young (Gina,Jade).zip.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\japanese cum sperm uncut hole young (Janette).mpeg.exe 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 340 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2440 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 28 PID 1888 wrote to memory of 2440 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 28 PID 1888 wrote to memory of 2440 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 28 PID 1888 wrote to memory of 2440 1888 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 28 PID 2440 wrote to memory of 340 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 29 PID 2440 wrote to memory of 340 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 29 PID 2440 wrote to memory of 340 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 29 PID 2440 wrote to memory of 340 2440 1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe"C:\Users\Admin\AppData\Local\Temp\1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe"C:\Users\Admin\AppData\Local\Temp\1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe"C:\Users\Admin\AppData\Local\Temp\1cc32313ee2cd2bada1b6345a87e17780dcb3e3129727693a229e644450727c5.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:340
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Windows Sidebar\Shared Gadgets\american beastiality beast uncut hole (Sandy,Curtney).zip.exe
- Size 1.4MB
- SHA256 ab08bf344f63abf890ce6b53ae25c9cd5f9462f8691c5f4c266ec973310359fb
- MD5 c62c62fe32c99745d631a2a9b0d4d1aa
- SHA1 4449d242523c338d929f3e0e379a27b232d8f7fc
- SHA512 faf342d5b72608a7a3480dc9823ccb9e10d8aa7f5bf0e86535a78ed634087ba313a3ce3c58d1c959aab7b72e86acacfb6a68bcb5f2a6cd4c787b77743fd4dfe0
- SSDEEP 24576:VlnGD9Ca6lqRDg7p6J75SqY9XVGcYuRkgBCMZ7YNJZY:WulqDg96ClVJRkJu7oJZY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\debug.txt
- Size 183B
- SHA256 08e25f784919232a985b347166ea635169a5d752bf78d646470e5f5deea8bf5b
- MD5 60be499b58a13c8e4735c40a5a33e3eb
- SHA1 07620fe19d3fdf0acac45f783aa6fe61df6767ea
- SHA512 eac004663b8e3589eb978fb891dc20106d7ae4c8b672303de77728e7c9974aca4889256355f8d149eeb26dca02972fa6dc1e8c2c7906241e214cde3272a9a78a
- MD5 SHA1 SHA512