f632980e16caca28269eba1e32bd29300ce52dc7969744758de3d279eaa3605f

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8f70ef6aaa0978edbd807986717ab9c.exe
Size

186KB
MD5

b8f70ef6aaa0978edbd807986717ab9c
SHA1

ceb99aceb55b3190f2872602331df4dcd07abc52
SHA256

f632980e16caca28269eba1e32bd29300ce52dc7969744758de3d279eaa3605f
SHA512

55ffebb18265653e6ae6fc68d53f57bf134e1a26b9908ae8b37963f1168c6172a181f61fe97f2015cbc8b7e6e1ae7de13ee5d94848b0cad48a419820d8ffed2e
SSDEEP

3072:gjbLl/gvQoutp1Tj4mYWR/RO/6W5H6gWIK+/MRzZfHbw/hftz7utwo7UGwsvU:gjluQoS3Io5RW6W5fMN9Hs/hftHkoGwj

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2244-0-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/files/0x0007000000015cce-5.dat	upx
behavioral1/memory/2544-76-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1924-89-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2244-93-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2544-102-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1924-103-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2244-104-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2244-108-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2244-111-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2244-114-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2244-119-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2244-122-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2244-125-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2244-128-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2244-131-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2244-134-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2244-137-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2244-140-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2244-143-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	b8f70ef6aaa0978edbd807986717ab9c.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\H:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\I:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\L:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\O:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\P:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\V:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\Y:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\E:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\K:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\T:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\U:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\X:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\B:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\G:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\J:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\M:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\N:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\Q:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\R:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\W:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\A:	b8f70ef6aaa0978edbd807986717ab9c.exe
File opened (read-only)	\??\Z:	b8f70ef6aaa0978edbd807986717ab9c.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\horse public boots (Sonja,Sylvia).rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\SysWOW64\IME\shared\trambling sleeping .mpeg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\SysWOW64\IME\shared\blowjob catfight .rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\SysWOW64\config\systemprofile\black action gay public glans hairy (Sarah).mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\black porn sperm hot (!) mistress .mpeg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\SysWOW64\FxsTmp\british hardcore girls hole .mpeg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\japanese nude lingerie voyeur titts shoes .mpeg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\SysWOW64\config\systemprofile\trambling lesbian upskirt .mpeg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\american cumshot horse licking glans .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\SysWOW64\FxsTmp\fucking [free] hole .zip.exe	b8f70ef6aaa0978edbd807986717ab9c.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Journal\Templates\swedish nude blowjob several models cock penetration .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Program Files (x86)\Google\Temp\beast several models glans young (Janette).zip.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\sperm public beautyfull (Anniston,Samantha).zip.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\lingerie [milf] feet (Anniston,Samantha).avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\handjob hardcore public cock YEâPSè& .zip.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\japanese nude trambling full movie cock fishy .zip.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Program Files (x86)\Google\Update\Download\swedish gang bang hardcore several models upskirt .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\italian horse sperm uncut hole bedroom .rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\fucking voyeur hole ¤ã .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\horse lesbian .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\danish gang bang sperm uncut glans .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Program Files\DVD Maker\Shared\tyrkish porn lingerie [bangbus] glans wifey .mpeg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\black action sperm big gorgeoushorny .zip.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\horse hot (!) cock .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\indian porn beast big hole .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\black cum xxx several models glans mature (Curtney).zip.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\british gay [milf] young (Kathrin,Janette).rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\blowjob voyeur mistress .rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\japanese handjob lingerie sleeping feet .rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\danish beastiality lesbian hidden feet shower .rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\asian sperm licking ash .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\brasilian beastiality gay [free] hole traffic (Tatjana).mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\chinese blowjob lesbian feet .mpeg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\cumshot sperm girls black hairunshaved .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\spanish trambling several models mature .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\InstallTemp\canadian horse big 40+ .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\horse full movie cock .rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\swedish beastiality horse voyeur feet .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\xxx licking (Liz).avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\cum fucking [bangbus] titts .zip.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\danish action lingerie catfight 40+ .mpeg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\black handjob fucking catfight hole pregnant .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\blowjob masturbation leather .rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\swedish animal blowjob hot (!) feet wifey .zip.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\french lingerie uncut stockings .rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\assembly\tmp\lingerie public glans circumcision .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\american horse lesbian girls .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\tyrkish handjob beast girls 50+ (Kathrin,Curtney).avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\trambling [bangbus] .rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\spanish horse sleeping (Sylvia).mpeg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\chinese hardcore several models .zip.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\italian porn horse catfight circumcision (Jenna,Janette).mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\Downloaded Program Files\black kicking lingerie licking hole .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\asian lingerie full movie latex .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\african bukkake uncut boots (Jenna,Sylvia).avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\chinese gay masturbation .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\swedish beastiality trambling several models .mpeg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\animal blowjob girls .mpeg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\PLA\Templates\italian kicking horse full movie .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\japanese gang bang lesbian uncut feet sweet .rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\fucking full movie .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\canadian blowjob uncut .rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\cumshot fucking hidden cock leather (Samantha).rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\chinese trambling big gorgeoushorny (Ashley,Tatjana).mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\canadian beast hidden .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\italian beastiality gay voyeur .zip.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\italian action bukkake [bangbus] cock bondage (Liz).zip.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\brasilian beastiality hardcore hot (!) hole .mpeg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\indian gang bang hardcore full movie glans wifey .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\asian lesbian sleeping glans .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\blowjob licking titts gorgeoushorny .rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\beast uncut bondage .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\russian cum blowjob public feet upskirt .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\bukkake lesbian .zip.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\Temp\bukkake [milf] .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\fucking [milf] stockings .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\italian porn gay masturbation blondie .mpeg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\indian action sperm [bangbus] (Melissa).avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\hardcore girls cock hotel .avi.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\beastiality gay licking granny .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\horse trambling voyeur (Sylvia).mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\trambling girls .zip.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\bukkake [bangbus] feet upskirt .rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\tyrkish beastiality hardcore big (Jade).mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\canadian bukkake several models bondage .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\russian gang bang trambling catfight glans penetration (Melissa).mpeg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\kicking sperm hidden .mpg.exe	b8f70ef6aaa0978edbd807986717ab9c.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\lesbian [milf] beautyfull .rar.exe	b8f70ef6aaa0978edbd807986717ab9c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe
2244	b8f70ef6aaa0978edbd807986717ab9c.exe
2544	b8f70ef6aaa0978edbd807986717ab9c.exe
1924	b8f70ef6aaa0978edbd807986717ab9c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2544	2244	b8f70ef6aaa0978edbd807986717ab9c.exe	28
PID 2244 wrote to memory of 2544	2244	b8f70ef6aaa0978edbd807986717ab9c.exe	28
PID 2244 wrote to memory of 2544	2244	b8f70ef6aaa0978edbd807986717ab9c.exe	28
PID 2244 wrote to memory of 2544	2244	b8f70ef6aaa0978edbd807986717ab9c.exe	28
PID 2544 wrote to memory of 1924	2544	b8f70ef6aaa0978edbd807986717ab9c.exe	29
PID 2544 wrote to memory of 1924	2544	b8f70ef6aaa0978edbd807986717ab9c.exe	29
PID 2544 wrote to memory of 1924	2544	b8f70ef6aaa0978edbd807986717ab9c.exe	29
PID 2544 wrote to memory of 1924	2544	b8f70ef6aaa0978edbd807986717ab9c.exe	29

C:\Users\Admin\AppData\Local\Temp\b8f70ef6aaa0978edbd807986717ab9c.exe
"C:\Users\Admin\AppData\Local\Temp\b8f70ef6aaa0978edbd807986717ab9c.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\b8f70ef6aaa0978edbd807986717ab9c.exe
  "C:\Users\Admin\AppData\Local\Temp\b8f70ef6aaa0978edbd807986717ab9c.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Users\Admin\AppData\Local\Temp\b8f70ef6aaa0978edbd807986717ab9c.exe
    "C:\Users\Admin\AppData\Local\Temp\b8f70ef6aaa0978edbd807986717ab9c.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\japanese nude trambling full movie cock fishy .zip.exe

Filesize
718KB

MD5
41302d4cccc5c909282313572e9a95f4

SHA1
a82fa3afa9ba9377d348355065f44827499ea2bd

SHA256
931dea536264d3bb2be8e85f435978ec500bbd274b4b42d2df01a0012991d133

SHA512
a69e3fa7f9db543336e8eb25290c4e88d344db773f83b8d9a4290d7ed8b200c9744f1c3aaf82b7b0bb9380ec70c08988d06c28af564a73176527208046785480

Download Submit
memory/1924-89-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1924-103-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-107-0x0000000005460000-0x0000000005480000-memory.dmp

Filesize
128KB

Download
memory/2244-111-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-143-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-93-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-140-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-75-0x0000000005460000-0x0000000005480000-memory.dmp

Filesize
128KB

Download
memory/2244-104-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-108-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-114-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-119-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-122-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-125-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-128-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-131-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-134-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2544-88-0x0000000004DD0000-0x0000000004DF0000-memory.dmp

Filesize
128KB

Download
memory/2544-102-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2544-76-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download