5ff952a681d31d7f2dad201fd23572dc39c07a89530434c6a2f4097f76ee321a

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b04571fa81d48387fc39a6e156a014ea.exe
Size

1.3MB
MD5

b04571fa81d48387fc39a6e156a014ea
SHA1

ae94cca44f04f4595aea1ad55dc54aa0d693aa9e
SHA256

5ff952a681d31d7f2dad201fd23572dc39c07a89530434c6a2f4097f76ee321a
SHA512

2ba3e049d04d5f7b05ee6fc35beec3fa8e0c63b6052705ad0dd556e8a694cc6a28026f662ee2fcc602fba9e0b189cd42203ee10dcf37729677cf9631d931832e
SSDEEP

24576:lUT8TXG014m5VZMn2/8ipWybZIFEAoje3Q4sOY78dex2oVuJKbmOnF4S:+uG0mm/ZEPiWaaGOYoOuJOPFb

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1276-0-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x0007000000015c52-5.dat	upx
behavioral1/memory/2660-66-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1648-91-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-93-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2660-96-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1648-105-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-106-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-107-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-111-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-114-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-117-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-122-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-125-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-128-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-131-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-134-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-137-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-140-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-143-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1276-146-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	b04571fa81d48387fc39a6e156a014ea.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\Y:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\L:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\M:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\O:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\Q:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\S:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\H:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\I:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\K:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\P:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\N:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\V:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\A:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\B:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\E:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\G:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\X:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\Z:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\J:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\T:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\U:	b04571fa81d48387fc39a6e156a014ea.exe
File opened (read-only)	\??\W:	b04571fa81d48387fc39a6e156a014ea.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FxsTmp\tyrkish animal blowjob lesbian hole .avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\SysWOW64\config\systemprofile\trambling licking (Sarah).mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\System32\DriverStore\Temp\lesbian uncut fishy .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\SysWOW64\FxsTmp\hardcore several models glans girly .zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\danish fetish sperm sleeping sweet .avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\SysWOW64\IME\shared\italian nude bukkake lesbian glans lady .zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\italian porn xxx hidden swallow .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\SysWOW64\IME\shared\bukkake [bangbus] (Janette).mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\SysWOW64\config\systemprofile\brasilian fetish blowjob uncut .mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian beastiality gay several models titts swallow (Tatjana).rar.exe	b04571fa81d48387fc39a6e156a014ea.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\lingerie licking (Jade).mpeg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\horse hot (!) titts bedroom .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\russian action bukkake several models (Jade).mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\japanese horse trambling big stockings .mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\blowjob girls cock upskirt .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Program Files\Windows Journal\Templates\black animal blowjob uncut gorgeoushorny .zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Program Files (x86)\Google\Temp\black handjob sperm uncut feet castration .mpeg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Program Files (x86)\Google\Update\Download\fucking big beautyfull (Sandy,Sylvia).mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\black handjob hardcore catfight high heels (Sandy,Samantha).mpeg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\black cumshot beast sleeping circumcision .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\bukkake [milf] feet ejaculation .avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\gay licking hole .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Program Files\DVD Maker\Shared\trambling [bangbus] hole (Kathrin,Melissa).avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\american handjob sperm [bangbus] leather .zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\black action trambling [free] .avi.exe	b04571fa81d48387fc39a6e156a014ea.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\asian gay masturbation sm .avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\canadian bukkake [bangbus] shower (Sonja,Melissa).avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\cumshot horse hidden feet ash (Melissa).zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\tyrkish nude lesbian catfight titts beautyfull .mpeg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\tyrkish cumshot horse girls (Jade).zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\british xxx voyeur sm (Britney,Karin).mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\fetish fucking full movie .avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\french trambling sleeping cock swallow .zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\kicking fucking public .mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\swedish action hardcore sleeping femdom .zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\german bukkake public hole .mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\fetish blowjob licking ìï .mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\horse trambling [free] glans .mpeg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\bukkake public (Tatjana).zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\asian beast licking glans 40+ .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\british bukkake hidden titts boots (Tatjana).avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\lesbian hot (!) hole girly .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\gay sleeping high heels .avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\fucking [bangbus] .avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\mssrv.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\Downloaded Program Files\french lingerie full movie .mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\asian blowjob [milf] young .avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\gay uncut .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\russian beastiality sperm voyeur .zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\trambling [free] feet mistress .mpeg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\italian fetish gay sleeping feet mature .zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\african horse [milf] feet .mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\assembly\temp\lingerie full movie .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\fetish hardcore public .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\german beast hidden .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\swedish beastiality trambling big granny .avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\gang bang horse [milf] .mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\swedish fetish lesbian hidden shower (Anniston,Karin).rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\brasilian cumshot hardcore lesbian .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\black cumshot gay girls (Liz).mpeg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\lesbian [milf] feet .mpeg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\xxx public 50+ (Kathrin,Curtney).avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\brasilian fetish lesbian hot (!) hole .avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\italian nude trambling catfight .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\kicking sperm public glans stockings .zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\tyrkish fetish horse [milf] (Karin).zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\horse bukkake several models feet upskirt (Janette).avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\canadian sperm catfight (Janette).rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\italian gang bang bukkake uncut hole .mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\tyrkish kicking blowjob full movie mature .mpeg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\black fetish trambling hot (!) .mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\lingerie uncut glans girly (Karin).avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\xxx public latex .mpeg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\american handjob bukkake big mistress .zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\beast several models hotel .mpg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\canadian xxx lesbian hole leather (Curtney).mpeg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\action gay uncut titts gorgeoushorny .avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\Temp\danish kicking bukkake [milf] hairy (Kathrin,Curtney).mpeg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\black cumshot fucking voyeur (Samantha).rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\german hardcore girls hole shoes .avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\gay [milf] latex (Sonja,Karin).rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\norwegian blowjob full movie glans stockings .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\italian action hardcore several models cock .mpeg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\fucking uncut shoes (Christine,Curtney).mpeg.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\assembly\tmp\black kicking fucking hidden hole ìï .avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\danish handjob beast [free] .zip.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\sperm uncut feet stockings (Janette).avi.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\danish gang bang blowjob full movie feet balls .rar.exe	b04571fa81d48387fc39a6e156a014ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\american gang bang fucking [free] titts ejaculation (Melissa).rar.exe	b04571fa81d48387fc39a6e156a014ea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe
1276	b04571fa81d48387fc39a6e156a014ea.exe
2660	b04571fa81d48387fc39a6e156a014ea.exe
1648	b04571fa81d48387fc39a6e156a014ea.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2660	1276	b04571fa81d48387fc39a6e156a014ea.exe	28
PID 1276 wrote to memory of 2660	1276	b04571fa81d48387fc39a6e156a014ea.exe	28
PID 1276 wrote to memory of 2660	1276	b04571fa81d48387fc39a6e156a014ea.exe	28
PID 1276 wrote to memory of 2660	1276	b04571fa81d48387fc39a6e156a014ea.exe	28
PID 2660 wrote to memory of 1648	2660	b04571fa81d48387fc39a6e156a014ea.exe	29
PID 2660 wrote to memory of 1648	2660	b04571fa81d48387fc39a6e156a014ea.exe	29
PID 2660 wrote to memory of 1648	2660	b04571fa81d48387fc39a6e156a014ea.exe	29
PID 2660 wrote to memory of 1648	2660	b04571fa81d48387fc39a6e156a014ea.exe	29

C:\Users\Admin\AppData\Local\Temp\b04571fa81d48387fc39a6e156a014ea.exe
"C:\Users\Admin\AppData\Local\Temp\b04571fa81d48387fc39a6e156a014ea.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\b04571fa81d48387fc39a6e156a014ea.exe
  "C:\Users\Admin\AppData\Local\Temp\b04571fa81d48387fc39a6e156a014ea.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Users\Admin\AppData\Local\Temp\b04571fa81d48387fc39a6e156a014ea.exe
    "C:\Users\Admin\AppData\Local\Temp\b04571fa81d48387fc39a6e156a014ea.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\american handjob sperm [bangbus] leather .zip.exe

Filesize
764KB

MD5
158e91d187283c0fd88732414a8374a5

SHA1
2ea5b50e6a1baf94ee21c177822b40c786c1b4b7

SHA256
005bceea723d47d934df487934ebe188054557e2c7ed110e43aac55624d146fc

SHA512
705d69d909ba6f87a5948d386e1f83fdc502e08a322e2286b931e325f8d656393c1b3875e3138db156847420ff654a4b7ac2a87a2406f66509a766f8e10b3e58

Download Submit
C:\debug.txt

Filesize
183B

MD5
18d921512e00853f8ad2e21993045d93

SHA1
682ca191fd8484272928b43ec16aec600b225d91

SHA256
0b84c13c8a9fa608e99b2537177a79929d7fa90345455fd70a7f1bc9dcd06c46

SHA512
7db95900b92e91fdc9a812d9c457af0c58e094e13a3dc2cb23929b0e0b371d36106c3f74a21f24bbbfc2d0aae376ae788303f19dc32cc76ff0860329527a5fce

Download Submit
memory/1276-108-0x00000000051B0000-0x00000000051CB000-memory.dmp

Filesize
108KB

Download
memory/1276-106-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-146-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-143-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-93-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-140-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-65-0x00000000051B0000-0x00000000051CB000-memory.dmp

Filesize
108KB

Download
memory/1276-114-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-111-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-107-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-137-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-134-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-117-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-122-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-125-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-128-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1276-131-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1648-105-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1648-91-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2660-66-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2660-96-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2660-90-0x00000000044A0000-0x00000000044BB000-memory.dmp

Filesize
108KB

Download