Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 01:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe
-
Size
670KB
-
MD5
15861d1278c16eeaefc7829c95067ff7
-
SHA1
02b98a26753da7e5886bce1048875c085b8b970f
-
SHA256
b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7
-
SHA512
001d09b08de15f9bdbfebd6a515cdff50c7068bd6420095de91877000dac1cdfd95e11f0a2a68a2a60231cdb6465bf582efa10517632308d0036ca00897521b9
-
SSDEEP
12288:lXa8smf49kRMcBrNF6xVfs35BssQPx8Pq6UTdUV1eetulMsN/h:lq8zRMcrUlkMFPx8YimQulMsFh
Score
9/10
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 17 IoCs
resource yara_rule behavioral1/memory/2420-63-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-90-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/3040-91-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-93-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-94-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-98-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-111-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-114-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-117-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-126-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-129-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-134-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-137-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-140-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-143-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-146-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2336-149-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral1/memory/2336-0-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/files/0x0007000000016c1e-5.dat UPX behavioral1/memory/2336-16-0x00000000048C0000-0x00000000048DC000-memory.dmp UPX behavioral1/memory/2420-63-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-90-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/3040-91-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-93-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-94-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-98-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-111-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-114-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-117-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-126-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-129-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-134-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-137-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-140-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-143-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-146-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2336-149-0x0000000000400000-0x000000000041C000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\E: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\J: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\O: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\Q: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\R: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\S: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\X: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\Z: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\A: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\G: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\H: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\I: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\L: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\W: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\M: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\N: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\P: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\B: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\K: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\T: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\V: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File opened (read-only) \??\Y: b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\FxsTmp\gang bang xxx catfight hole girly .rar.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\danish beastiality lesbian public (Curtney).rar.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\SysWOW64\FxsTmp\lingerie licking titts beautyfull (Sylvia).rar.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\SysWOW64\config\systemprofile\tyrkish handjob fucking hot (!) penetration .mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\trambling public sweet (Christine,Tatjana).mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\System32\DriverStore\Temp\tyrkish nude lingerie licking glans traffic .zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\SysWOW64\IME\shared\black beastiality beast lesbian latex .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\SysWOW64\IME\shared\danish beastiality horse big .zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\SysWOW64\config\systemprofile\beast voyeur hole .mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lingerie hidden (Sarah).mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\danish handjob fucking [bangbus] glans shoes (Curtney).zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Program Files\Windows Journal\Templates\swedish action blowjob public cock castration .zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Program Files (x86)\Common Files\microsoft shared\sperm several models (Karin).mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Program Files (x86)\Google\Temp\american nude xxx uncut titts granny .mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\indian porn lingerie girls bedroom .mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\american handjob lesbian masturbation hole .mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\xxx public titts pregnant .mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\black fetish beast catfight cock blondie .rar.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\brasilian kicking hardcore [free] hole .zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\brasilian fetish lingerie voyeur titts ejaculation (Samantha).mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Program Files (x86)\Microsoft Office\Templates\danish cumshot horse sleeping cock redhair (Karin).mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Program Files\DVD Maker\Shared\brasilian kicking trambling lesbian high heels .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Program Files (x86)\Google\Update\Download\brasilian fetish fucking licking latex (Anniston,Melissa).zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\xxx masturbation .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\swedish cumshot bukkake hidden circumcision .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\lingerie sleeping titts balls .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\action sperm full movie femdom (Ashley,Karin).zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\sperm [milf] .mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\indian cum lesbian full movie .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\italian animal lingerie [bangbus] cock (Anniston,Curtney).zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\american cum lingerie sleeping feet pregnant .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\french lesbian [bangbus] young (Anniston,Tatjana).mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\fetish xxx hidden cock ash .mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\black animal lingerie full movie hole femdom (Curtney).mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\animal trambling masturbation titts .mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\indian kicking lingerie [free] pregnant .mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\brasilian gang bang hardcore [bangbus] glans shower .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\american porn bukkake lesbian latex .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\norwegian sperm masturbation feet .zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\japanese action xxx hot (!) titts hairy .zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\fucking sleeping bondage .mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\trambling public (Curtney).zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\nude xxx girls glans (Sonja,Curtney).mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\asian fucking masturbation glans beautyfull .mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\action xxx sleeping glans .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\swedish kicking lingerie hidden mature .zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\american fetish trambling lesbian sweet .rar.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\canadian fucking big fishy .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\InstallTemp\gang bang gay public glans .mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\nude gay girls titts sm .mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\italian gang bang hardcore licking swallow .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\canadian gay hot (!) hole (Kathrin,Curtney).mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\action fucking public (Sarah).mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\bukkake girls (Jade).avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\tyrkish beastiality horse catfight boots .mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\african gay catfight hole leather .rar.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\nude hardcore big feet circumcision .rar.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\japanese porn bukkake masturbation black hairunshaved (Christine,Samantha).zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\swedish animal lingerie [free] hotel .mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\african horse big feet sweet .rar.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\hardcore voyeur titts 40+ .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\asian fucking catfight glans ìï (Melissa).mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\porn gay full movie .zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\fucking [free] .mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\black gang bang beast [bangbus] .mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\Temp\black cum fucking hot (!) bondage (Kathrin,Tatjana).mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\french fucking voyeur glans black hairunshaved .zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\malaysia bukkake public YEâPSè& (Britney,Melissa).zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\black cum lingerie catfight feet .rar.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\canadian beast girls balls .mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\german lesbian hot (!) hotel .mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\spanish blowjob girls circumcision .zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\spanish fucking hidden hole penetration (Melissa).avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\indian horse sperm [milf] circumcision (Christine,Sarah).mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\chinese fucking uncut pregnant .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\swedish porn horse sleeping (Karin).mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\beastiality bukkake hidden hole .zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\blowjob sleeping (Sarah).mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\xxx hidden (Karin).mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\tyrkish fetish blowjob voyeur 50+ .zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\mssrv.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\handjob beast voyeur glans .rar.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\japanese animal hardcore public gorgeoushorny .zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\danish horse xxx public titts fishy (Karin).mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\assembly\temp\tyrkish beastiality beast several models glans mistress .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\chinese hardcore big young .avi.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\asian hardcore full movie feet (Britney,Jade).mpg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian beastiality blowjob full movie blondie .mpeg.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\british gay [bangbus] .zip.exe b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 2420 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2336 wrote to memory of 3040 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 28 PID 2336 wrote to memory of 3040 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 28 PID 2336 wrote to memory of 3040 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 28 PID 2336 wrote to memory of 3040 2336 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 28 PID 3040 wrote to memory of 2420 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 29 PID 3040 wrote to memory of 2420 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 29 PID 3040 wrote to memory of 2420 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 29 PID 3040 wrote to memory of 2420 3040 b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe"C:\Users\Admin\AppData\Local\Temp\b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe"C:\Users\Admin\AppData\Local\Temp\b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe"C:\Users\Admin\AppData\Local\Temp\b80bda13861a240dce8695573fe38a5ede6319e6c96a8b52e9d1d54552edcaf7.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2420
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
561KB
MD581f0f71df82c9f9f9a8547189482ffb8
SHA11ea13e120e22c34d46abc1d91fea35722d79874d
SHA256ef13be588b5b86650936b0c6df166fd933397db730e0d9fc6004e1a50f0a2cfb
SHA5121003d52ab2213d33d16e46bbcd9e4a59627f27e1cf79e0f15d16a92089051ccdd657d299ea1f80a32ff25391e6420340d6517d47d0c5c85b93bb4359dffa0a24
-
Filesize
183B
MD541c2058b8006ee28d25f8e461fe5891d
SHA1690851eb9a20e9c491d32c2d0aef7f183cbfc862
SHA25644123e978a8aad48aa0328cc77df673fedaa886e0ebcfa91125949016debf96b
SHA512aba7393ec384d2ae9187810e276bb5fccd76128b7e99b5567a9e892a899d9e3121102cc1b625e70b50798b95e0cf420dcf0eb1948e7060f64eaa7e8fe04bb449