Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 22:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4edcd0bccdf36311e56f7a0abfc58a67.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
4edcd0bccdf36311e56f7a0abfc58a67.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
4edcd0bccdf36311e56f7a0abfc58a67.exe
-
Size
407KB
-
MD5
4edcd0bccdf36311e56f7a0abfc58a67
-
SHA1
5571ec2b92ae49c0a248469400abf93c11bc73f3
-
SHA256
dfcda277f7ec2e90d242da4e39d680c278cb822fa718b0a31a358d66f7b7a09f
-
SHA512
6c4ddb2f0f4d0ea0a537f226ad0c2c26a621bc8bd0525351a055aa6c847dccc5983a622404bd7b8d29042b9554c77948242b1ffad588773e17b4a21cbb64cd85
-
SSDEEP
6144:aDOxZXrSHXUTsiJcsSM0lo3uXfVBz2pGhTSPVLB4BKrim0T8+nzA9PCezWpg3m:lXa8si5SdV8cWtLW4rGQ+zA9qqjW
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 4edcd0bccdf36311e56f7a0abfc58a67.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\G: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\I: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\N: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\P: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\U: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\W: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\L: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\Q: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\S: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\X: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\Y: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\V: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\A: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\E: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\H: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\K: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\O: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\T: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\B: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\J: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\M: 4edcd0bccdf36311e56f7a0abfc58a67.exe File opened (read-only) \??\R: 4edcd0bccdf36311e56f7a0abfc58a67.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\xxx public titts .zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\System32\DriverStore\Temp\swedish gang bang bukkake hidden sm .mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\SysWOW64\FxsTmp\russian porn lesbian [milf] titts .mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\SysWOW64\IME\shared\sperm catfight penetration .zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\hardcore licking pregnant .mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\italian beastiality blowjob licking cock 40+ .zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\SysWOW64\config\systemprofile\danish gang bang lesbian [free] balls .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian porn horse hidden (Sarah).avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\SysWOW64\FxsTmp\italian beastiality trambling catfight circumcision .avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\SysWOW64\IME\shared\bukkake masturbation .avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\italian action lingerie catfight sweet (Christine,Jade).rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\fucking masturbation bondage (Sonja,Liz).mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\danish animal trambling public lady .avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\lesbian uncut cock mistress .mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Program Files\Windows Journal\Templates\italian beastiality fucking several models 40+ (Gina,Liz).zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\swedish fetish lesbian sleeping hole castration (Melissa).mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Program Files (x86)\Google\Update\Download\black animal beast [milf] glans .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Program Files\DVD Maker\Shared\swedish fetish beast several models swallow .mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Program Files (x86)\Google\Temp\trambling [milf] cock upskirt .zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\russian animal blowjob several models Χ .avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Program Files (x86)\Microsoft Office\Templates\tyrkish action fucking several models swallow .avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\brasilian gang bang lingerie catfight feet hotel .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\american nude lesbian voyeur fishy .avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Program Files (x86)\Common Files\microsoft shared\horse sleeping hole sweet .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\indian gang bang lingerie several models glans shoes (Curtney).mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\indian action lingerie public .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\handjob fucking uncut titts fishy .mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\danish beastiality sperm public (Curtney).avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\tyrkish handjob trambling full movie glans bedroom (Melissa).mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\malaysia bukkake [milf] shoes .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\chinese lingerie voyeur feet circumcision (Melissa).mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\porn gay masturbation titts beautyfull .avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\horse hardcore hot (!) titts traffic .mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\asian gay uncut feet shoes (Tatjana).avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\hardcore hot (!) glans .zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\Downloaded Program Files\italian animal beast full movie feet ô .mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\horse trambling [free] hole hairy .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\nude xxx sleeping glans latex .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\beastiality sperm lesbian mistress (Christine,Sylvia).mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\hardcore public glans hotel .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\swedish cumshot beast lesbian .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\handjob lesbian catfight (Tatjana).avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\italian action sperm public cock pregnant .zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\spanish hardcore full movie wifey .mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\black nude beast licking ejaculation .mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\brasilian fetish hardcore [free] high heels (Sandy,Melissa).avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\cum lesbian sleeping titts .mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\kicking gay [bangbus] feet lady .zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\african blowjob [bangbus] .mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\russian beastiality lesbian masturbation .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\tyrkish animal lesbian big 50+ .zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\assembly\tmp\brasilian porn blowjob hidden .zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian beastiality blowjob sleeping granny .zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\bukkake [bangbus] YEâPSè& .zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\horse lesbian [milf] cock .zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\beast several models mature .avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\canadian trambling voyeur beautyfull .mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\fetish sperm hot (!) traffic .mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\russian beastiality lesbian [bangbus] .mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\bukkake licking .mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\russian action blowjob big titts pregnant .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\french gay masturbation hole .zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\chinese gay several models feet .mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\beastiality fucking catfight .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\handjob fucking lesbian (Samantha).zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\russian gang bang blowjob licking girly .avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\african bukkake voyeur titts bedroom .avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\porn lingerie girls gorgeoushorny .mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\bukkake licking feet bedroom (Melissa).mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\norwegian gay masturbation (Tatjana).mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\italian porn horse several models cock ash .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\tyrkish animal trambling big high heels .mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\blowjob public feet sweet .avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\russian nude xxx [bangbus] hole .avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\beast hot (!) (Tatjana).mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\bukkake lesbian feet ash .mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\german sperm [bangbus] penetration .mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\fetish xxx voyeur shower .rar.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\russian porn hardcore several models .mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\french lingerie several models ejaculation (Ashley,Liz).avi.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\cum sperm lesbian (Tatjana).zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\cum hardcore [bangbus] .mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\japanese nude fucking big cock shoes (Sylvia).zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\handjob gay voyeur feet 40+ .mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\swedish horse xxx girls circumcision (Anniston,Janette).mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\blowjob masturbation cock .zip.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\spanish horse voyeur feet .mpeg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\russian animal beast [bangbus] cock swallow .mpg.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe File created C:\Windows\mssrv.exe 4edcd0bccdf36311e56f7a0abfc58a67.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 2424 4edcd0bccdf36311e56f7a0abfc58a67.exe 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2604 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 28 PID 1912 wrote to memory of 2604 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 28 PID 1912 wrote to memory of 2604 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 28 PID 1912 wrote to memory of 2604 1912 4edcd0bccdf36311e56f7a0abfc58a67.exe 28 PID 2604 wrote to memory of 2424 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 29 PID 2604 wrote to memory of 2424 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 29 PID 2604 wrote to memory of 2424 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 29 PID 2604 wrote to memory of 2424 2604 4edcd0bccdf36311e56f7a0abfc58a67.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\4edcd0bccdf36311e56f7a0abfc58a67.exe"C:\Users\Admin\AppData\Local\Temp\4edcd0bccdf36311e56f7a0abfc58a67.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\4edcd0bccdf36311e56f7a0abfc58a67.exe"C:\Users\Admin\AppData\Local\Temp\4edcd0bccdf36311e56f7a0abfc58a67.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\4edcd0bccdf36311e56f7a0abfc58a67.exe"C:\Users\Admin\AppData\Local\Temp\4edcd0bccdf36311e56f7a0abfc58a67.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2424
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Sidebar\Shared Gadgets\swedish fetish lesbian sleeping hole castration (Melissa).mpg.exe
Filesize1.9MB
MD54af8beafe05392b5b3b9f8012bcc7097
SHA17cabf7905ce7ea6c4ad1861405dbbe73ace67087
SHA256edec7beb0c4211831804621b9cc46e2b4ce8e03c6dfe1ddd87715dbc0ff6526a
SHA512e03c230d734c21d45c083977b1a4d66fc111ee9740e386843584ce8bab9ab31881494df40a2243c72814f1ed124324732a40b4123c319eaef5374e29e46dcf98