Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 05:26
Behavioral task
behavioral1
Sample
0580cc34e72ddb155da3fd8b0155a6ea.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
0580cc34e72ddb155da3fd8b0155a6ea.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
0580cc34e72ddb155da3fd8b0155a6ea.exe
-
Size
187KB
-
MD5
0580cc34e72ddb155da3fd8b0155a6ea
-
SHA1
46631ece551393a326559ce595a34607d29fb193
-
SHA256
5c1807fe69c1612ff2beba505a2fe6a1d3a2c103473a129be15dff6b1b470dd9
-
SHA512
e17a27de9fbe7ca0016fd695609dfe74790279e58d10bf5b0e7fd6ceb8a9b29c10ae779319cc90379f4ce1e8c3b6ce78ecae350e384d8f0d209d0ffeaf2fd65f
-
SSDEEP
3072:gjbLl/gvQoutqsEB6hcxkG6Q8JKJGFEZpYuY9Nux3Ncp1kr3AEJ:gjluQoSbulx4Q8sGKnYuY9NuxdwS3AEJ
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2372-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x0007000000015023-5.dat upx behavioral1/memory/2656-52-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1276-88-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2372-90-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1276-102-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2372-103-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2372-108-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2372-111-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2372-114-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2372-119-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2372-122-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2372-125-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2372-128-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2372-131-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2372-134-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2372-137-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2372-140-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2372-143-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 0580cc34e72ddb155da3fd8b0155a6ea.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\I: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\Q: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\R: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\S: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\A: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\E: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\M: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\U: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\H: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\L: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\N: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\O: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\P: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\B: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\G: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\J: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\K: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\Y: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\T: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\V: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\W: 0580cc34e72ddb155da3fd8b0155a6ea.exe File opened (read-only) \??\X: 0580cc34e72ddb155da3fd8b0155a6ea.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish horse bukkake [bangbus] sm .avi.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\SysWOW64\FxsTmp\blowjob licking glans ash (Liz).zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\SysWOW64\FxsTmp\american beastiality xxx sleeping titts upskirt (Sarah).zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\SysWOW64\config\systemprofile\danish kicking bukkake masturbation cock .avi.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\System32\DriverStore\Temp\beast public castration .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\SysWOW64\IME\shared\fucking sleeping black hairunshaved .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\swedish cumshot xxx catfight gorgeoushorny .mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\SysWOW64\config\systemprofile\blowjob catfight (Jade).avi.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\blowjob hot (!) stockings (Sonja,Karin).mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\SysWOW64\IME\shared\trambling lesbian girly .mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\danish animal trambling several models stockings .avi.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Program Files (x86)\Google\Temp\indian porn lingerie lesbian ash .mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\bukkake masturbation (Melissa).rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\beast big mature .zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\american gang bang blowjob [milf] titts boots (Janette).rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Program Files (x86)\Google\Update\Download\tyrkish handjob lesbian sleeping cock young (Curtney).mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\bukkake hidden Χ .mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Program Files\DVD Maker\Shared\japanese porn blowjob [free] (Sarah).zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Program Files\Windows Journal\Templates\indian cum fucking [bangbus] lady .zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Program Files (x86)\Common Files\microsoft shared\italian handjob lesbian licking hole mature .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\danish porn lingerie masturbation swallow .zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\japanese cum fucking public sm .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Program Files (x86)\Microsoft Office\Templates\sperm public feet swallow .zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Program Files\Common Files\Microsoft Shared\lesbian public granny (Gina,Curtney).rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\brasilian cum sperm catfight cock ejaculation .mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\italian kicking hardcore several models (Jade).mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\assembly\temp\lesbian masturbation (Sarah).mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\action trambling full movie boots .mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\horse [milf] 50+ .mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\russian porn fucking voyeur hotel .mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\assembly\tmp\indian fetish fucking girls titts circumcision .mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\nude gay girls mistress .zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\japanese horse blowjob [free] hole .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\indian porn horse lesbian cock .mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\tyrkish cumshot xxx voyeur .zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\fucking sleeping upskirt .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\Temp\danish cum beast masturbation titts .mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\cumshot blowjob sleeping cock .mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\chinese horse girls latex .zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\russian porn hardcore catfight titts beautyfull .mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\chinese trambling lesbian (Janette).mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\blowjob girls glans young .mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\danish cumshot horse big .zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\cum bukkake [free] .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\trambling girls .mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\animal lingerie sleeping feet .mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\japanese porn bukkake full movie glans hairy (Tatjana).mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\cum fucking hidden titts hotel .mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\Downloaded Program Files\russian kicking gay [bangbus] titts blondie .zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\russian beastiality horse voyeur hole .mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\porn beast licking young .zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\kicking sperm big titts .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\black gang bang lesbian [milf] sweet (Kathrin,Sylvia).rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\beast masturbation feet 40+ .avi.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\PLA\Templates\black nude blowjob sleeping .mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\russian beastiality sperm [milf] titts swallow .avi.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\SoftwareDistribution\Download\russian kicking fucking [free] ash .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\japanese nude horse voyeur balls .avi.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\InstallTemp\action horse [free] glans .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\gay catfight bondage .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\lesbian several models hole .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\japanese handjob lingerie big beautyfull .avi.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\horse gay full movie titts girly .avi.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\horse masturbation hole ejaculation .mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\horse masturbation mature (Britney,Melissa).mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\animal blowjob full movie hole YEâPSè& .avi.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\spanish beast big glans .mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\german hardcore several models hole castration (Liz).zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\french fucking hidden .mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\hardcore hot (!) castration (Britney,Karin).rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\trambling masturbation (Sylvia).avi.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\kicking sperm lesbian redhair .zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\danish cumshot fucking [free] .zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\lesbian catfight traffic .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\animal xxx girls sm .avi.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\swedish nude beast licking sweet .mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\chinese fucking sleeping feet .avi.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\handjob hardcore masturbation (Tatjana).zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\french lingerie licking ash .mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\danish horse hardcore [milf] .mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\american fetish xxx [bangbus] (Melissa).avi.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\horse fucking hot (!) .zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\canadian bukkake hot (!) .mpg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\chinese bukkake [bangbus] stockings .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\indian nude lingerie girls glans shower .mpeg.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\bukkake sleeping feet (Christine,Jade).rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\malaysia blowjob licking titts .rar.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\porn bukkake [free] lady .zip.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe File created C:\Windows\mssrv.exe 0580cc34e72ddb155da3fd8b0155a6ea.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 1276 0580cc34e72ddb155da3fd8b0155a6ea.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2656 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 28 PID 2372 wrote to memory of 2656 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 28 PID 2372 wrote to memory of 2656 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 28 PID 2372 wrote to memory of 2656 2372 0580cc34e72ddb155da3fd8b0155a6ea.exe 28 PID 2656 wrote to memory of 1276 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 29 PID 2656 wrote to memory of 1276 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 29 PID 2656 wrote to memory of 1276 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 29 PID 2656 wrote to memory of 1276 2656 0580cc34e72ddb155da3fd8b0155a6ea.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0580cc34e72ddb155da3fd8b0155a6ea.exe"C:\Users\Admin\AppData\Local\Temp\0580cc34e72ddb155da3fd8b0155a6ea.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\0580cc34e72ddb155da3fd8b0155a6ea.exe"C:\Users\Admin\AppData\Local\Temp\0580cc34e72ddb155da3fd8b0155a6ea.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\0580cc34e72ddb155da3fd8b0155a6ea.exe"C:\Users\Admin\AppData\Local\Temp\0580cc34e72ddb155da3fd8b0155a6ea.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1276
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Sidebar\Shared Gadgets\brasilian cum sperm catfight cock ejaculation .mpg.exe
Filesize885KB
MD54e1f4843ac550399958aa49b5d1a9e0f
SHA16b95f8415d350db6f8266f265706bab52fbcea36
SHA256b055d4f43fe0245a307b59b98ac1593dbf2a5fffee876c6e1f3241b4bc260b12
SHA5127c6c199b02c43e61f1651a8a502e746624c42113ecdac088c462740a167c5da2f368b8fe601fe9d667769fa3a8c5aadf5ff76deb155b752f09e59164b52068ee