744df2bf8cdd01a0aabdce41163d1afaa7fc8a6d24a251cb827ac5c4a04e1f8c

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

416ecc3e7a04e5539213a1fabe676b9b.exe
Size

2.0MB
MD5

416ecc3e7a04e5539213a1fabe676b9b
SHA1

d5db9c24f32f72b243ba297cf999573d659ecfdb
SHA256

744df2bf8cdd01a0aabdce41163d1afaa7fc8a6d24a251cb827ac5c4a04e1f8c
SHA512

468a3096b5aa1b6aeb904c3a62096ea5f4c739b7e25be9c58a29fa089632b2b0344a1ac4ef580da00940e1009ec721dc66cc16bc3cea743d94b716c2e49f7ca0
SSDEEP

24576:t2gC7mNdosj6Aqb1eaOXTA/FNyA/kSnM5Nh2XABwE9t72ggdiG2fcwnjYNJi4B5C:QgC7mNgSXT2yHAkhnpt72cxdJ4BiBnT

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2340-0-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/files/0x0007000000016c7c-5.dat	upx
behavioral1/memory/2612-66-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2752-90-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-92-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2612-95-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2752-104-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-106-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-105-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-111-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-114-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-117-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-122-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-125-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-128-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-131-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-134-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-137-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-140-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-143-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2340-146-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	416ecc3e7a04e5539213a1fabe676b9b.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\J:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\L:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\N:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\W:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\X:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\H:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\P:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\R:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\S:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\Z:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\A:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\B:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\G:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\I:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\K:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\M:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\O:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\Q:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\T:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\U:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\V:	416ecc3e7a04e5539213a1fabe676b9b.exe
File opened (read-only)	\??\Y:	416ecc3e7a04e5539213a1fabe676b9b.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\gang bang voyeur Ôë (Janette).mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\SysWOW64\FxsTmp\kicking big .rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\SysWOW64\config\systemprofile\cumshot licking sm .rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\black beast lesbian feet beautyfull .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\SysWOW64\FxsTmp\american bukkake hot (!) pregnant .mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\SysWOW64\IME\shared\asian kicking gay [free] (Jenna,Sonja).mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian fucking big .rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\System32\DriverStore\Temp\norwegian cum masturbation shower .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\SysWOW64\IME\shared\cumshot public .rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\indian cum lesbian girls 40+ .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\indian horse gay hidden boobs (Melissa).mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\danish horse [milf] lady .mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\blowjob public boots .avi.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\canadian handjob girls mature (Sonja,Jade).zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Program Files\DVD Maker\Shared\action uncut ash sweet (Sonja).rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\malaysia fetish licking 40+ .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Program Files (x86)\Google\Temp\hardcore [milf] cock ash .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\beastiality [free] swallow .rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\german lingerie beast masturbation hole ejaculation .avi.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Program Files\Windows Journal\Templates\hardcore hot (!) .avi.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\porn big ash pregnant .rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\indian cumshot several models high heels .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Program Files (x86)\Google\Update\Download\chinese gay uncut granny .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\nude sleeping hole .mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\brasilian fucking lesbian .rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\horse voyeur hole bedroom .mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\horse voyeur traffic (Sarah).avi.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian fucking sperm hidden traffic .rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\bukkake catfight circumcision (Sylvia).mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\xxx voyeur glans .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\animal beastiality full movie hole stockings .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\canadian kicking beast lesbian hole .rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\japanese cum [free] .mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\african lingerie action several models boots .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\lesbian cum uncut glans pregnant .rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\gay public redhair .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\horse fucking big 50+ .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\french kicking hot (!) .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\xxx girls high heels .mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\asian lesbian full movie .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\spanish sperm uncut cock .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\german cumshot porn uncut .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\hardcore animal uncut hole ìï .avi.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\fucking beastiality uncut titts (Melissa).rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\italian porn lesbian masturbation mature (Jenna).rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\swedish fetish beast [free] pregnant .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\PLA\Templates\canadian xxx several models feet stockings .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\italian sperm bukkake big (Sylvia,Kathrin).mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\african sperm sperm voyeur .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\french fetish bukkake voyeur wifey .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\german fetish lesbian girls circumcision .avi.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\blowjob hot (!) hole .mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\hardcore licking (Britney,Jade).avi.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\asian horse girls .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\asian cum uncut nipples hotel .mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\assembly\tmp\danish trambling hot (!) (Britney).rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\asian action cum hidden .rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\chinese horse public wifey (Christine).mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\hardcore lingerie hot (!) .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\gang bang licking leather .mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\tyrkish cumshot cum uncut cock beautyfull (Jade,Karin).mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\gang bang girls (Jade).rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\canadian cum hot (!) .rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\chinese horse animal [free] .avi.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\cum [bangbus] 50+ (Anniston,Kathrin).rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\brasilian action hardcore uncut sweet (Sonja).mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\french nude lesbian [free] young .mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\british animal voyeur beautyfull .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\danish sperm [bangbus] mistress (Liz,Samantha).mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\italian cumshot lesbian shower (Sandy,Jade).mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\malaysia gang bang several models nipples .avi.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\beastiality [bangbus] upskirt .mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\danish gang bang lesbian nipples .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\chinese kicking public .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\security\templates\gang bang cum full movie cock stockings (Kathrin).mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\british fetish action sleeping 50+ .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\lesbian blowjob several models boots (Liz,Britney).rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\african beast masturbation wifey .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\Temp\french cum catfight nipples ash .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\brasilian fetish beast [bangbus] upskirt .mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\hardcore several models nipples castration .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\chinese cum gay [bangbus] boots .mpeg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\lingerie fucking big 40+ .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\Downloaded Program Files\beast trambling public blondie .mpg.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\danish cum fucking lesbian legs blondie .rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\action sleeping titts .zip.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\chinese gay uncut glans young (Sonja).rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\spanish sperm lingerie full movie boots .rar.exe	416ecc3e7a04e5539213a1fabe676b9b.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\porn [free] .avi.exe	416ecc3e7a04e5539213a1fabe676b9b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe
2340	416ecc3e7a04e5539213a1fabe676b9b.exe
2612	416ecc3e7a04e5539213a1fabe676b9b.exe
2752	416ecc3e7a04e5539213a1fabe676b9b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2612	2340	416ecc3e7a04e5539213a1fabe676b9b.exe	28
PID 2340 wrote to memory of 2612	2340	416ecc3e7a04e5539213a1fabe676b9b.exe	28
PID 2340 wrote to memory of 2612	2340	416ecc3e7a04e5539213a1fabe676b9b.exe	28
PID 2340 wrote to memory of 2612	2340	416ecc3e7a04e5539213a1fabe676b9b.exe	28
PID 2612 wrote to memory of 2752	2612	416ecc3e7a04e5539213a1fabe676b9b.exe	29
PID 2612 wrote to memory of 2752	2612	416ecc3e7a04e5539213a1fabe676b9b.exe	29
PID 2612 wrote to memory of 2752	2612	416ecc3e7a04e5539213a1fabe676b9b.exe	29
PID 2612 wrote to memory of 2752	2612	416ecc3e7a04e5539213a1fabe676b9b.exe	29

C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe
"C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe
  "C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe
    "C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\danish horse [milf] lady .mpeg.exe

Filesize
760KB

MD5
c146dfc022662c200780d06787fc7067

SHA1
c02eca0f6ed50b2e76830e0050e7829dc9470ca5

SHA256
fd3b078ec8dd5e22f1581fc0396608185458b67897e4edc37f35a4c5dfc6308f

SHA512
c32546a56552ee677f887ce84f555db3bd622c94f920c1b7dfffafc2bd7afece42b6f643999fd53fcbe5456ac8adbe2e602cff551c21617f8b5930d478b62703

Download Submit
memory/2340-128-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-105-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-146-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-143-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-140-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-92-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-107-0x0000000005700000-0x000000000571D000-memory.dmp

Filesize
116KB

Download
memory/2340-137-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-106-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-131-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-64-0x0000000005700000-0x000000000571D000-memory.dmp

Filesize
116KB

Download
memory/2340-134-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-125-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-114-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-117-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-122-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-111-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2340-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2612-110-0x00000000045C0000-0x00000000045DD000-memory.dmp

Filesize
116KB

Download
memory/2612-95-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2612-89-0x00000000045C0000-0x00000000045DD000-memory.dmp

Filesize
116KB

Download
memory/2612-66-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2752-104-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2752-90-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download