Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 22:57
Behavioral task
behavioral1
Sample
88d2098e827e08d3e10cee021d36e784.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
88d2098e827e08d3e10cee021d36e784.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
88d2098e827e08d3e10cee021d36e784.exe
-
Size
998KB
-
MD5
88d2098e827e08d3e10cee021d36e784
-
SHA1
342e8ef4cf3a19f5a6853035975f5a33ced66d25
-
SHA256
1112fd0d16f252b0c832b67b89d746f068b71d75c3374497aec104f4d933ea68
-
SHA512
3e01b05867932f3a96da0bed2ae4856c722302a827a3f147a317859307473d29e20f5aedc0bfd7abda263653220fe1fe0cebc1cafa1761774dfc25875fc0d554
-
SSDEEP
24576:0FwdLa76IKg1UpriqxAnQ8kFIs31gjR9Cpmns:uwqN1Kvxr8kFJOFE8ns
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2128-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/files/0x0007000000015be6-5.dat upx behavioral1/memory/2652-56-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2208-87-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-93-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2652-95-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-108-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-107-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-112-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-115-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-118-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-123-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-126-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-129-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-132-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-135-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-138-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-141-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-144-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2128-147-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 88d2098e827e08d3e10cee021d36e784.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\N: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\S: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\K: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\M: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\O: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\P: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\Q: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\A: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\E: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\I: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\V: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\Y: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\U: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\X: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\B: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\J: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\T: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\W: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\Z: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\G: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\L: 88d2098e827e08d3e10cee021d36e784.exe File opened (read-only) \??\R: 88d2098e827e08d3e10cee021d36e784.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\lingerie sleeping .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\gay full movie ash .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\System32\DriverStore\Temp\brasilian bukkake [free] boobs stockings .avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\SysWOW64\IME\shared\kicking girls shoes .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\SysWOW64\config\systemprofile\porn gay masturbation .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\trambling uncut .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\SysWOW64\FxsTmp\american xxx trambling catfight beautyfull .avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\SysWOW64\FxsTmp\japanese gay catfight girly (Samantha).avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\kicking public (Sarah,Gina).mpeg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\SysWOW64\IME\shared\nude lingerie big sweet .mpeg.exe 88d2098e827e08d3e10cee021d36e784.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\asian lesbian beastiality voyeur sweet .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Program Files (x86)\Microsoft Office\Templates\lesbian gay hidden (Samantha,Sarah).zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\asian xxx fetish masturbation sm .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Program Files\DVD Maker\Shared\german lesbian porn hot (!) hole high heels .avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\handjob horse hidden glans .mpeg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\canadian cumshot big .avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Program Files\Windows Journal\Templates\xxx gay uncut redhair .avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Program Files (x86)\Google\Temp\beast action licking .avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Program Files (x86)\Google\Update\Download\canadian kicking gay hot (!) 40+ (Jenna,Melissa).avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Program Files\Common Files\Microsoft Shared\japanese xxx trambling [milf] bedroom .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Program Files (x86)\Common Files\microsoft shared\swedish gay [bangbus] .avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\lingerie cumshot licking .rar.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\black xxx horse licking wifey (Jenna).rar.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\african lesbian girls (Sylvia).mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\blowjob sperm catfight .avi.exe 88d2098e827e08d3e10cee021d36e784.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\NetworkService\Downloads\american beastiality blowjob big pregnant .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\american cum voyeur high heels .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\french horse girls .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\gang bang sperm big nipples upskirt .avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\assembly\temp\russian cum full movie (Samantha,Jade).zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\british lesbian lesbian gorgeoushorny .mpeg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\canadian fetish lesbian ìï (Sarah).mpeg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\fucking lesbian hole wifey (Gina,Christine).zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\swedish kicking voyeur .mpeg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\danish lesbian fetish several models .avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\swedish cumshot sleeping nipples .rar.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\horse [bangbus] circumcision .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\PLA\Templates\asian lingerie trambling hidden nipples .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\russian cumshot [free] legs high heels .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\tyrkish fetish sleeping shoes (Ashley,Sarah).avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\asian fetish girls high heels (Tatjana,Melissa).mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\gay gang bang several models nipples beautyfull .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\gay beast licking traffic .rar.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\porn [bangbus] ejaculation .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\action action full movie hole .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\nude xxx [bangbus] feet .avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\malaysia bukkake big cock .rar.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\german hardcore catfight 40+ .mpeg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\african nude animal hot (!) feet castration .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\danish cum horse big upskirt .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\brasilian bukkake horse big nipples bondage .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\cum beastiality sleeping balls .rar.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\spanish gay hot (!) high heels .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\british bukkake [bangbus] high heels .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\american sperm sleeping nipples .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\spanish fucking girls high heels .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\fetish big .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\horse full movie mature .avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\sperm lesbian .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\norwegian animal sperm [milf] shoes .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\lesbian [milf] 40+ (Christine,Jade).rar.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\sperm xxx [free] hole .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\lingerie cum voyeur .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\mssrv.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\african trambling full movie .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\italian lingerie hardcore full movie mature (Jenna,Sonja).mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\brasilian porn licking hotel .mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\fetish sperm hot (!) .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\SoftwareDistribution\Download\nude voyeur boobs latex .rar.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\italian lingerie kicking lesbian hole (Liz).zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\horse hidden boobs YEâPSè& .rar.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\italian sperm beast lesbian titts .mpeg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\german cumshot uncut feet young .rar.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\cumshot lesbian (Kathrin).mpg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\lingerie xxx voyeur girly .avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\xxx horse [milf] titts ìï .mpeg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\black action voyeur (Kathrin,Tatjana).zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\british blowjob beastiality licking granny .mpeg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\nude trambling several models .mpeg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\malaysia horse public feet .mpeg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\horse several models sm .rar.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\lingerie horse uncut nipples .zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\spanish beast hot (!) black hairunshaved (Kathrin,Melissa).avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\danish kicking gang bang voyeur feet mistress .mpeg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\russian gay kicking [free] .mpeg.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\canadian gay beastiality several models swallow .avi.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\german sperm action public hole hotel (Sonja,Sylvia).rar.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\action big shoes (Sarah,Christine).zip.exe 88d2098e827e08d3e10cee021d36e784.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\swedish action cum [free] legs wifey (Sonja).mpg.exe 88d2098e827e08d3e10cee021d36e784.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe 2128 88d2098e827e08d3e10cee021d36e784.exe 2652 88d2098e827e08d3e10cee021d36e784.exe 2208 88d2098e827e08d3e10cee021d36e784.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2652 2128 88d2098e827e08d3e10cee021d36e784.exe 28 PID 2128 wrote to memory of 2652 2128 88d2098e827e08d3e10cee021d36e784.exe 28 PID 2128 wrote to memory of 2652 2128 88d2098e827e08d3e10cee021d36e784.exe 28 PID 2128 wrote to memory of 2652 2128 88d2098e827e08d3e10cee021d36e784.exe 28 PID 2652 wrote to memory of 2208 2652 88d2098e827e08d3e10cee021d36e784.exe 29 PID 2652 wrote to memory of 2208 2652 88d2098e827e08d3e10cee021d36e784.exe 29 PID 2652 wrote to memory of 2208 2652 88d2098e827e08d3e10cee021d36e784.exe 29 PID 2652 wrote to memory of 2208 2652 88d2098e827e08d3e10cee021d36e784.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\88d2098e827e08d3e10cee021d36e784.exe"C:\Users\Admin\AppData\Local\Temp\88d2098e827e08d3e10cee021d36e784.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\88d2098e827e08d3e10cee021d36e784.exe"C:\Users\Admin\AppData\Local\Temp\88d2098e827e08d3e10cee021d36e784.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\88d2098e827e08d3e10cee021d36e784.exe"C:\Users\Admin\AppData\Local\Temp\88d2098e827e08d3e10cee021d36e784.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2208
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD561c26538175c2e4942609709b232681c
SHA1e9638f883f5599a52cb71f0defbbde9aa9698d37
SHA25654d26ff50d7d0da89383a4d1d7b4d0064045c76d7b91cafaa7a715795e804b52
SHA512bc77ee594a08cbe7a8a9f3937193e1c37724a7164850608607d16d821d0a03cfd4d26e1901280e23d3aacef876875f6bff7e4d657df7136faf99ae5ce9704978