Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-04-2024 01:21
Behavioral task
behavioral1
Sample
c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe
Resource
win10v2004-20240226-en
General
-
Target
c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe
-
Size
443KB
-
MD5
9907fa9b3b7e49e8c07dac25dd8f983c
-
SHA1
a112b50a25347f9b8de1bc672a3ad51dc3aa8bad
-
SHA256
c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50
-
SHA512
685effc295a4cc414245dd23eeeadb4715b4200db1bd065c0874d28bd904b65abbf2a0e61175debeb8789bf111d152e1943be88a222251f8b7cb3453d4f02a8e
-
SSDEEP
12288:YEQoSnqh42GYs5P6FqcpTTf2sRKkxwVx5/dhoz:Yo/s5P6qWfttxOx5/joz
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2892-77-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1248-94-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2564-98-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2892-100-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1248-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/files/0x0007000000016d10-5.dat UPX behavioral1/memory/1248-53-0x0000000004CE0000-0x0000000004CFE000-memory.dmp UPX behavioral1/memory/2564-54-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2892-77-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1248-94-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2564-98-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2892-100-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1248-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/files/0x0007000000016d10-5.dat upx behavioral1/memory/1248-53-0x0000000004CE0000-0x0000000004CFE000-memory.dmp upx behavioral1/memory/2564-54-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2892-77-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1248-94-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2564-98-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2892-100-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exedescription ioc Process File opened (read-only) \??\A: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\E: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\G: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\I: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\J: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\K: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\S: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\M: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\N: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\O: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\R: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\T: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\W: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\L: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\U: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\V: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\X: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\Z: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\B: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\H: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\P: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\Q: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File opened (read-only) \??\Y: c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe -
Drops file in System32 directory 10 IoCs
Processes:
c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exedescription ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\spanish lesbian voyeur cock (Kathrin).mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\System32\DriverStore\Temp\sperm nude public young .avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\swedish handjob blowjob catfight redhair (Melissa,Sylvia).mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\SysWOW64\FxsTmp\canadian trambling girls (Melissa,Sonja).mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\SysWOW64\IME\shared\hardcore several models high heels .zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\SysWOW64\config\systemprofile\malaysia fetish sleeping black hairunshaved .zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\SysWOW64\FxsTmp\british nude uncut beautyfull .mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\SysWOW64\IME\shared\german hardcore public boobs mature (Anniston,Samantha).zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\SysWOW64\config\systemprofile\african kicking [free] circumcision .zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\gang bang lesbian bondage .zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe -
Drops file in Program Files directory 15 IoCs
Processes:
c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exedescription ioc Process File created C:\Program Files\DVD Maker\Shared\gay [milf] .rar.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\beastiality licking nipples traffic (Ashley).avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\tyrkish lingerie big legs .rar.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\horse big sweet .mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\british gang bang licking vagina upskirt .mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Program Files\Common Files\Microsoft Shared\lesbian beastiality catfight .mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Program Files\Windows Journal\Templates\swedish lesbian big upskirt (Janette).rar.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\handjob licking (Sonja).avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\kicking uncut titts .zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Program Files (x86)\Microsoft Office\Templates\italian fetish trambling girls cock shower .mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\swedish gay sleeping nipples .rar.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Program Files (x86)\Common Files\microsoft shared\xxx [bangbus] legs balls .rar.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Program Files (x86)\Google\Temp\cumshot hidden .mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Program Files (x86)\Google\Update\Download\italian sperm catfight wifey .rar.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\brasilian gay blowjob voyeur .zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe -
Drops file in Windows directory 64 IoCs
Processes:
c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exedescription ioc Process File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\african action [bangbus] vagina sweet (Gina,Sylvia).avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\italian lesbian xxx licking boobs mature (Jenna,Kathrin).rar.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\british animal fucking uncut black hairunshaved .avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\black lingerie beast sleeping penetration (Tatjana).mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\mssrv.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\canadian cumshot girls .avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\japanese cum fucking sleeping vagina blondie (Tatjana,Sandy).zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\canadian porn lingerie hidden nipples (Janette).avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\tyrkish action gay big boobs young .mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\chinese gang bang hardcore uncut hole ejaculation (Sarah).mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\spanish xxx girls .mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\asian sperm gang bang lesbian glans sm .mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\nude animal lesbian swallow .mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\horse licking .rar.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\nude [free] mistress .rar.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\beastiality horse [free] .rar.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\gang bang full movie boobs ejaculation .mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\tyrkish xxx [milf] (Britney,Anniston).mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\canadian cumshot full movie (Ashley).mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\lesbian hardcore [bangbus] shoes (Liz,Curtney).zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\indian beastiality nude catfight .mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\gang bang horse [milf] .mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\handjob hot (!) nipples upskirt .mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\canadian cum uncut (Anniston,Tatjana).mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\spanish nude [free] shower .mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\american xxx public .avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\bukkake nude girls fishy .zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\tyrkish gang bang public vagina .rar.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\malaysia lingerie handjob masturbation young (Jenna).mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\danish gang bang fucking licking vagina .mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\brasilian action several models granny .mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\russian xxx hot (!) (Ashley).zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\horse cumshot several models traffic (Ashley).zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\italian fetish lesbian .mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\chinese kicking [free] ash ash .avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\blowjob licking latex .zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\chinese beast kicking hidden boots .avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\norwegian trambling [free] legs (Sandy,Jade).avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\horse [bangbus] fishy .zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\nude public .zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\british lingerie xxx masturbation swallow .mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\chinese horse licking penetration .mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\american beast full movie vagina redhair .avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\horse xxx masturbation boobs black hairunshaved (Sonja).mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\brasilian xxx nude big sweet (Jenna).mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\german fetish public blondie (Liz,Kathrin).avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\beast fetish hidden redhair .mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\french fucking gay girls .mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\spanish xxx voyeur YEâPSè& .rar.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\spanish sperm xxx girls ash .avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\beastiality several models (Anniston).mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\swedish nude uncut young (Sylvia).mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\handjob horse several models upskirt .zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\black fucking bukkake [bangbus] sm (Sonja).avi.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\beast sperm voyeur YEâPSè& .mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\animal [bangbus] .mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\asian action animal big boobs wifey .mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\malaysia cumshot fucking hot (!) ejaculation .zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\british nude hardcore girls hole ejaculation .mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\indian blowjob [bangbus] ash .rar.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\indian cum masturbation hole .mpeg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\indian cum cumshot catfight .zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\russian animal big beautyfull .zip.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\norwegian lingerie hidden mature .mpg.exe c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exec7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exec7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exepid Process 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 2892 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exec7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exedescription pid Process procid_target PID 1248 wrote to memory of 2564 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 28 PID 1248 wrote to memory of 2564 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 28 PID 1248 wrote to memory of 2564 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 28 PID 1248 wrote to memory of 2564 1248 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 28 PID 2564 wrote to memory of 2892 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 29 PID 2564 wrote to memory of 2892 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 29 PID 2564 wrote to memory of 2892 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 29 PID 2564 wrote to memory of 2892 2564 c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe"C:\Users\Admin\AppData\Local\Temp\c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe"C:\Users\Admin\AppData\Local\Temp\c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe"C:\Users\Admin\AppData\Local\Temp\c7ebd8eca6b37b033ff128fba3ab963f06e0710165f7218add3843d3b64c4d50.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2892
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD55f64b7de39f30fc92638977f342221c8
SHA168f4e90d6b19f26d3acd0282b0ff5bbc1ce31eae
SHA2562ccbb23d52452b100e7fae81f2a93e17fe442ffb9df4e96c30e3879761d2702d
SHA512d14523fec52a8d1c78e8fa43ddbfca788b558c1c64a196c349d3f8c34837dc93066312aadeac5936588d1e679b6f2051457f920e0243837e8087eeb0691a4508