Analysis
- max time kernel
150s - max time network
146s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
09/04/2024, 22:20
Behavioral task
behavioral1
Sample
416ecc3e7a04e5539213a1fabe676b9b.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
416ecc3e7a04e5539213a1fabe676b9b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 416ecc3e7a04e5539213a1fabe676b9b.exe
- Size 2.0MB
- Sample240409-189e5sed62
- SHA256 744df2bf8cdd01a0aabdce41163d1afaa7fc8a6d24a251cb827ac5c4a04e1f8c
- MD5 416ecc3e7a04e5539213a1fabe676b9b
- SHA1 d5db9c24f32f72b243ba297cf999573d659ecfdb
- SHA512 468a3096b5aa1b6aeb904c3a62096ea5f4c739b7e25be9c58a29fa089632b2b0344a1ac4ef580da00940e1009ec721dc66cc16bc3cea743d94b716c2e49f7ca0
- SSDEEP 24576:t2gC7mNdosj6Aqb1eaOXTA/FNyA/kSnM5Nh2XABwE9t72ggdiG2fcwnjYNJi4B5C:QgC7mNgSXT2yHAkhnpt72cxdJ4BiBnT
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2340-0-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/files/0x0007000000016c7c-5.dat upx behavioral1/memory/2612-66-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2752-90-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-92-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2612-95-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2752-104-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-106-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-105-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-111-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-114-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-117-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-122-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-125-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-128-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-131-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-134-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-137-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-140-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-143-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2340-146-0x0000000000400000-0x000000000041D000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 416ecc3e7a04e5539213a1fabe676b9b.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\J: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\L: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\N: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\W: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\X: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\H: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\P: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\R: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\S: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\Z: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\A: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\B: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\G: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\I: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\K: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\M: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\O: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\Q: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\T: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\U: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\V: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\Y: 416ecc3e7a04e5539213a1fabe676b9b.exe - Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\gang bang voyeur Ôë (Janette).mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\FxsTmp\kicking big .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\config\systemprofile\cumshot licking sm .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\black beast lesbian feet beautyfull .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\FxsTmp\american bukkake hot (!) pregnant .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\IME\shared\asian kicking gay [free] (Jenna,Sonja).mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian fucking big .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\System32\DriverStore\Temp\norwegian cum masturbation shower .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\IME\shared\cumshot public .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\indian cum lesbian girls 40+ .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\indian horse gay hidden boobs (Melissa).mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\danish horse [milf] lady .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Microsoft Office\Templates\blowjob public boots .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\canadian handjob girls mature (Sonja,Jade).zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files\DVD Maker\Shared\action uncut ash sweet (Sonja).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\malaysia fetish licking 40+ .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Google\Temp\hardcore [milf] cock ash .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\beastiality [free] swallow .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\german lingerie beast masturbation hole ejaculation .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files\Windows Journal\Templates\hardcore hot (!) .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\porn big ash pregnant .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Common Files\microsoft shared\indian cumshot several models high heels .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Google\Update\Download\chinese gay uncut granny .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\nude sleeping hole .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\brasilian fucking lesbian .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\NetworkService\Downloads\horse voyeur hole bedroom .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\horse voyeur traffic (Sarah).avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian fucking sperm hidden traffic .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\bukkake catfight circumcision (Sylvia).mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\xxx voyeur glans .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\animal beastiality full movie hole stockings .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\canadian kicking beast lesbian hole .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\japanese cum [free] .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\african lingerie action several models boots .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\lesbian cum uncut glans pregnant .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\gay public redhair .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\horse fucking big 50+ .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\french kicking hot (!) .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\xxx girls high heels .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\asian lesbian full movie .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\spanish sperm uncut cock .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\german cumshot porn uncut .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\hardcore animal uncut hole ìï .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\fucking beastiality uncut titts (Melissa).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\italian porn lesbian masturbation mature (Jenna).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\swedish fetish beast [free] pregnant .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\PLA\Templates\canadian xxx several models feet stockings .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\italian sperm bukkake big (Sylvia,Kathrin).mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\african sperm sperm voyeur .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\french fetish bukkake voyeur wifey .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\german fetish lesbian girls circumcision .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\blowjob hot (!) hole .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\hardcore licking (Britney,Jade).avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\asian horse girls .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\asian cum uncut nipples hotel .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\assembly\tmp\danish trambling hot (!) (Britney).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\asian action cum hidden .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\chinese horse public wifey (Christine).mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\hardcore lingerie hot (!) .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\gang bang licking leather .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\tyrkish cumshot cum uncut cock beautyfull (Jade,Karin).mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\gang bang girls (Jade).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\canadian cum hot (!) .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\chinese horse animal [free] .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\cum [bangbus] 50+ (Anniston,Kathrin).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\brasilian action hardcore uncut sweet (Sonja).mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\french nude lesbian [free] young .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\british animal voyeur beautyfull .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\danish sperm [bangbus] mistress (Liz,Samantha).mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\italian cumshot lesbian shower (Sandy,Jade).mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\malaysia gang bang several models nipples .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\beastiality [bangbus] upskirt .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\danish gang bang lesbian nipples .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\chinese kicking public .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\security\templates\gang bang cum full movie cock stockings (Kathrin).mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\british fetish action sleeping 50+ .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\lesbian blowjob several models boots (Liz,Britney).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\african beast masturbation wifey .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\Temp\french cum catfight nipples ash .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\brasilian fetish beast [bangbus] upskirt .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\hardcore several models nipples castration .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\chinese cum gay [bangbus] boots .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\lingerie fucking big 40+ .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\Downloaded Program Files\beast trambling public blondie .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\danish cum fucking lesbian legs blondie .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\action sleeping titts .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\chinese gay uncut glans young (Sonja).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\spanish sperm lingerie full movie boots .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\porn [free] .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 2752 416ecc3e7a04e5539213a1fabe676b9b.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2612 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 28 PID 2340 wrote to memory of 2612 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 28 PID 2340 wrote to memory of 2612 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 28 PID 2340 wrote to memory of 2612 2340 416ecc3e7a04e5539213a1fabe676b9b.exe 28 PID 2612 wrote to memory of 2752 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 29 PID 2612 wrote to memory of 2752 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 29 PID 2612 wrote to memory of 2752 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 29 PID 2612 wrote to memory of 2752 2612 416ecc3e7a04e5539213a1fabe676b9b.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2752
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Windows Sidebar\Shared Gadgets\danish horse [milf] lady .mpeg.exe
- Size 760KB
- SHA256 fd3b078ec8dd5e22f1581fc0396608185458b67897e4edc37f35a4c5dfc6308f
- MD5 c146dfc022662c200780d06787fc7067
- SHA1 c02eca0f6ed50b2e76830e0050e7829dc9470ca5
- SHA512 c32546a56552ee677f887ce84f555db3bd622c94f920c1b7dfffafc2bd7afece42b6f643999fd53fcbe5456ac8adbe2e602cff551c21617f8b5930d478b62703
- SSDEEP 12288:tEQoS9qhA7Ju6S1yfapQC4DppoB1qmUrFNVBPzb1iuoRFl7gZJD7vjFpJyZRy74B:t2AFS1yyqppjm6F/BPAuozVgZJvvjfAz
- MD5 SHA1 SHA512 SSDEEP