Analysis
-
max time kernel
164s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 21:16
Behavioral task
behavioral1
Sample
07e81fbf3a228352d4bf586411e3deed.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
07e81fbf3a228352d4bf586411e3deed.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
07e81fbf3a228352d4bf586411e3deed.exe
-
Size
1.4MB
-
MD5
07e81fbf3a228352d4bf586411e3deed
-
SHA1
b0190b56986485076e12fef9e919e4829ac04b97
-
SHA256
e21563481d54b34c90da18a4ad068c98cbb1e5f5b42e3e1e58ff67327febb22e
-
SHA512
196155b5f7de600d656626b8c02ef447dd1d7e6c35257f418e2c8277f8bac0cf1a899ace5a03395e47ae7d65d34652aa191d1e89fb4ecebdc0558de3cefaf228
-
SSDEEP
24576:bHNlDOAt37OotrklrFnEXUAYOJJBTNuMAmkQ+tt4NLVBpXW71I4WtQFQOVab7cx:jNwAtJto5REEsJJBTYMAmkeBxtQFQCaq
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 07e81fbf3a228352d4bf586411e3deed.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 07e81fbf3a228352d4bf586411e3deed.exe -
resource yara_rule behavioral2/memory/3144-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000800000002326b-9.dat upx behavioral2/memory/2112-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-15-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 07e81fbf3a228352d4bf586411e3deed.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\H: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\L: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\M: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\Z: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\R: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\T: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\W: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\A: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\B: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\I: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\K: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\Q: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\G: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\J: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\V: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\X: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\Y: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\N: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\O: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\P: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\S: 07e81fbf3a228352d4bf586411e3deed.exe File opened (read-only) \??\U: 07e81fbf3a228352d4bf586411e3deed.exe -
Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\Shared Gadgets\nude gay several models .mpg.exe 07e81fbf3a228352d4bf586411e3deed.exe File created C:\Program Files\dotnet\shared\african lesbian fetish girls young (Britney).avi.exe 07e81fbf3a228352d4bf586411e3deed.exe File created C:\Program Files\Microsoft Office\root\Templates\french beastiality gang bang full movie penetration .avi.exe 07e81fbf3a228352d4bf586411e3deed.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\nude handjob catfight nipples boots .avi.exe 07e81fbf3a228352d4bf586411e3deed.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\handjob licking stockings .rar.exe 07e81fbf3a228352d4bf586411e3deed.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\porn nude catfight shower .rar.exe 07e81fbf3a228352d4bf586411e3deed.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\british bukkake animal several models cock redhair .mpeg.exe 07e81fbf3a228352d4bf586411e3deed.exe File created C:\Program Files\Common Files\microsoft shared\beastiality [free] nipples YEâPSè& (Gina).mpeg.exe 07e81fbf3a228352d4bf586411e3deed.exe File created C:\Program Files\Microsoft Office\Updates\Download\british gang bang hot (!) .avi.exe 07e81fbf3a228352d4bf586411e3deed.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\mssrv.exe 07e81fbf3a228352d4bf586411e3deed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3144 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 4904 07e81fbf3a228352d4bf586411e3deed.exe 4904 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 4904 07e81fbf3a228352d4bf586411e3deed.exe 4904 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 4904 07e81fbf3a228352d4bf586411e3deed.exe 4904 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 4904 07e81fbf3a228352d4bf586411e3deed.exe 4904 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 4904 07e81fbf3a228352d4bf586411e3deed.exe 4904 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 4904 07e81fbf3a228352d4bf586411e3deed.exe 4904 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 3144 07e81fbf3a228352d4bf586411e3deed.exe 4904 07e81fbf3a228352d4bf586411e3deed.exe 4904 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 2112 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe 5068 07e81fbf3a228352d4bf586411e3deed.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3144 wrote to memory of 2112 3144 07e81fbf3a228352d4bf586411e3deed.exe 97 PID 3144 wrote to memory of 2112 3144 07e81fbf3a228352d4bf586411e3deed.exe 97 PID 3144 wrote to memory of 2112 3144 07e81fbf3a228352d4bf586411e3deed.exe 97 PID 3144 wrote to memory of 5068 3144 07e81fbf3a228352d4bf586411e3deed.exe 98 PID 3144 wrote to memory of 5068 3144 07e81fbf3a228352d4bf586411e3deed.exe 98 PID 3144 wrote to memory of 5068 3144 07e81fbf3a228352d4bf586411e3deed.exe 98 PID 2112 wrote to memory of 4904 2112 07e81fbf3a228352d4bf586411e3deed.exe 99 PID 2112 wrote to memory of 4904 2112 07e81fbf3a228352d4bf586411e3deed.exe 99 PID 2112 wrote to memory of 4904 2112 07e81fbf3a228352d4bf586411e3deed.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\07e81fbf3a228352d4bf586411e3deed.exe"C:\Users\Admin\AppData\Local\Temp\07e81fbf3a228352d4bf586411e3deed.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\07e81fbf3a228352d4bf586411e3deed.exe"C:\Users\Admin\AppData\Local\Temp\07e81fbf3a228352d4bf586411e3deed.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\07e81fbf3a228352d4bf586411e3deed.exe"C:\Users\Admin\AppData\Local\Temp\07e81fbf3a228352d4bf586411e3deed.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4904
-
-
-
C:\Users\Admin\AppData\Local\Temp\07e81fbf3a228352d4bf586411e3deed.exe"C:\Users\Admin\AppData\Local\Temp\07e81fbf3a228352d4bf586411e3deed.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵PID:928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\handjob licking stockings .rar.exe
Filesize1.9MB
MD5b13edeb897449c94c029e8af8677d8c4
SHA141b8df580c79c5d6b0f41c8860a58972aeb4b029
SHA256da8ee731ab27d92d104a5226c6d5535a29fe2d183ff7d5c2b9b4aea3b2f0219c
SHA512d71dfa4c62e118d4d9f2b58888319cd0bbfa6726b78443c2c783c07701e6d4e4dee826ead6adbac5ae6b9f2be9209a0b5333f46a3377124b7b8aec3e8c209f0e