Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 20:25
Behavioral task
behavioral1
Sample
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe
Resource
win10v2004-20240226-en
General
-
Target
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe
-
Size
276KB
-
MD5
732aaa311c29f05aa811a89b4d0d1ac5
-
SHA1
a8b4098a8375feaf2d60cc2e8c89c38f21c8462a
-
SHA256
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3
-
SHA512
28f27280cf8da0d3f7f0904c6a0aab938ec464275d8cb92c71ac8646c9fea2ef3102d38256b32bb206ea6e11b793e50fe4030d1f92fc9c4d6fd023403602076d
-
SSDEEP
6144:VjluQoS3TpfT+xyFirBmVmjDlQCWqzqClW:VEQoS3Tp7+xyRYFQKzqj
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2672-39-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2436-67-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2860-95-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2672-99-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2436-104-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2860-0-0x0000000000400000-0x000000000041F000-memory.dmp UPX C:\Program Files\Windows Sidebar\Shared Gadgets\african beastiality uncut swallow .avi.exe UPX behavioral1/memory/2672-39-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral1/memory/2436-67-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral1/memory/2860-95-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral1/memory/2672-99-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral1/memory/2436-104-0x0000000000400000-0x000000000041F000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2860-0-0x0000000000400000-0x000000000041F000-memory.dmp upx C:\Program Files\Windows Sidebar\Shared Gadgets\african beastiality uncut swallow .avi.exe upx behavioral1/memory/2672-39-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2436-67-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2860-95-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2672-99-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2436-104-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exedescription ioc process File opened (read-only) \??\B: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\L: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\M: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\Q: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\U: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\E: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\H: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\S: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\W: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\Y: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\O: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\X: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\A: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\I: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\J: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\K: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\N: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\Z: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\G: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\P: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\R: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\T: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\V: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe -
Drops file in System32 directory 10 IoCs
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\hardcore xxx masturbation .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\IME\shared\sperm animal big .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\trambling several models (Sonja).mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\FxsTmp\norwegian animal full movie .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\IME\shared\american gay several models (Sonja).zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lingerie porn [bangbus] .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\System32\DriverStore\Temp\hardcore horse masturbation 50+ (Sarah).rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\FxsTmp\action sleeping titts circumcision (Janette).mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\config\systemprofile\japanese handjob voyeur lady (Sandy).rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\nude gang bang [free] (Jenna,Curtney).avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe -
Drops file in Program Files directory 15 IoCs
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exedescription ioc process File created C:\Program Files\DVD Maker\Shared\swedish action blowjob masturbation swallow .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files\Windows Journal\Templates\asian sperm fetish catfight swallow .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\african beastiality uncut swallow .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\norwegian horse [milf] mature .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\nude handjob girls sm .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Google\Temp\fucking [milf] boobs black hairunshaved .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\german fucking gay several models titts mistress .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files\Common Files\Microsoft Shared\french beast bukkake full movie (Sonja).zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\british animal cumshot [free] .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Common Files\microsoft shared\horse lesbian .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\swedish action porn big cock hotel .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Google\Update\Download\hardcore voyeur gorgeoushorny .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\canadian gang bang fucking several models hole swallow (Britney).mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Microsoft Office\Templates\beast gang bang sleeping sm .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\horse girls .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe -
Drops file in Windows directory 64 IoCs
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exedescription ioc process File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\malaysia gang bang hot (!) lady (Tatjana).zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\Temp\action beast catfight boots .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\xxx masturbation legs .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\russian cum voyeur cock .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\african hardcore public swallow .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\malaysia gang bang [bangbus] black hairunshaved .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\beastiality handjob [milf] cock granny .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\blowjob licking cock ejaculation .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\Downloaded Program Files\nude blowjob masturbation ash (Samantha,Sonja).mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\asian beastiality trambling catfight traffic .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\spanish blowjob sleeping hairy .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\canadian animal handjob hidden .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\canadian xxx beast masturbation .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\british handjob sleeping 40+ .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\malaysia trambling gay uncut shoes .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian sperm [free] boots .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\InstallTemp\gay uncut circumcision .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\japanese blowjob uncut .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\german fetish big .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\horse xxx voyeur glans young .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\porn [free] bondage .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\malaysia trambling lesbian .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\swedish trambling lesbian boobs wifey .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\sperm [milf] boobs bedroom .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\animal sperm [free] nipples (Sonja,Curtney).avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\russian cumshot full movie young .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\canadian cum [free] (Karin,Anniston).avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\indian lingerie kicking lesbian blondie .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\french action [bangbus] granny (Sarah).zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\american cum action hot (!) vagina shoes .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\porn lingerie uncut .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\japanese cumshot sleeping redhair .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\american nude big .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\african trambling fetish [milf] legs (Sylvia,Sylvia).mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\french kicking girls mature .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\cumshot gay girls .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\trambling [bangbus] .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\gay fetish girls .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\french gay big swallow (Tatjana).mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\bukkake full movie .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\blowjob sleeping pregnant .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\british kicking several models mistress (Tatjana).zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\swedish beast animal lesbian femdom .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\beastiality kicking sleeping (Curtney).avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\handjob public granny .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\assembly\temp\tyrkish horse hot (!) penetration .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\blowjob fucking full movie feet .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\cum [milf] hole bedroom .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\beast full movie boobs upskirt (Sandy).avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\british lingerie sleeping pregnant .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\swedish lingerie hidden nipples .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\action beast girls .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\handjob sleeping boobs young .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\norwegian trambling beastiality several models hole pregnant .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\bukkake catfight cock gorgeoushorny .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\spanish cumshot [free] circumcision .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\lesbian voyeur glans .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\hardcore [milf] hole .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\brasilian nude fetish licking .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\bukkake bukkake lesbian .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\beast several models (Melissa).mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\russian hardcore uncut vagina bondage .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\hardcore licking girly .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\french xxx xxx sleeping 40+ (Sandy,Sarah).mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exepid process 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2436 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exedescription pid process target process PID 2860 wrote to memory of 2672 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 2860 wrote to memory of 2672 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 2860 wrote to memory of 2672 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 2860 wrote to memory of 2672 2860 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 2672 wrote to memory of 2436 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 2672 wrote to memory of 2436 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 2672 wrote to memory of 2436 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 2672 wrote to memory of 2436 2672 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe"C:\Users\Admin\AppData\Local\Temp\415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe"C:\Users\Admin\AppData\Local\Temp\415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe"C:\Users\Admin\AppData\Local\Temp\415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD5186253aaee72846f70a5e40fdc69c530
SHA1f8d60dfa9ca9576d17453ae787533827a5c131c8
SHA256a09acdba087b0b77c33e8b241e8ae9c55da64e6f697db03a2176f403963e8fab
SHA51240543dad3c8ed87a725ea0d2623a15c6464c56d411616f466740ae5e2a56f0643dab9f504c05598c29f1d1ee1b08221206afb2ff3557367af6690b99816a6c5a