Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 21:40
Behavioral task
behavioral1
Sample
470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe
Resource
win10v2004-20240412-en
General
-
Target
470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe
-
Size
1.4MB
-
MD5
c77f6eb8013267b6f532a2763a1be23d
-
SHA1
f68201ff6b157d57dc0c9295b3185c18478f0ea5
-
SHA256
470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41
-
SHA512
c840d594e730ff12ab6def56bd43d4627248d877b3405fadc37a1a376af976789a9da0aae33ad1ef75c54022ef0f8ed6977a44576712ba40a838fe0b18c209ad
-
SSDEEP
24576:YiiJzjtQYCusD6rAHC1Mhf1cCC+GZJ5zuU5qSKcPbsu9jVT9rvGO3:xiJzjtQYC1eMC1IGJZ/yUUSKw7Trp
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 5 IoCs
resource yara_rule behavioral1/memory/2584-33-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2656-92-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2556-95-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2736-98-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2584-101-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral1/memory/2656-0-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/2556-5-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/files/0x0007000000015264-6.dat UPX behavioral1/memory/2736-32-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/2584-33-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/2656-92-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/2556-95-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/2736-98-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral1/memory/2584-101-0x0000000000400000-0x0000000000420000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2656-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2556-5-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x0007000000015264-6.dat upx behavioral1/memory/2736-32-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2584-33-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2656-92-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2556-95-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2736-98-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2584-101-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\U: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\V: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\M: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\B: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\L: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\N: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\R: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\X: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\Y: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\A: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\O: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\T: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\Z: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\H: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\G: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\I: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\J: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\K: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\P: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\Q: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\W: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File opened (read-only) \??\E: 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\japanese cumshot cum lesbian penetration (Sonja).avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\kicking beast licking mistress (Karin).avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\System32\DriverStore\Temp\british cumshot xxx hidden .zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\SysWOW64\FxsTmp\italian nude hidden (Janette,Curtney).mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\SysWOW64\IME\shared\asian cumshot hot (!) .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\japanese cum [bangbus] ash penetration (Sarah,Karin).avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\black porn licking .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\SysWOW64\config\systemprofile\fetish [free] beautyfull .zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\SysWOW64\FxsTmp\canadian porn [bangbus] lady .avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\SysWOW64\IME\shared\malaysia hardcore bukkake lesbian lady (Jade,Melissa).rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\british animal animal hot (!) wifey .mpg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Program Files\Windows Journal\Templates\african blowjob horse lesbian (Melissa).mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Program Files (x86)\Microsoft Office\Templates\japanese kicking sperm [bangbus] latex .mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Program Files (x86)\Google\Update\Download\italian trambling uncut gorgeoushorny .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\russian gang bang [milf] sm .mpg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\fucking beastiality full movie boobs .zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\kicking [bangbus] 40+ .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Program Files (x86)\Google\Temp\trambling animal sleeping feet .avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\brasilian kicking several models shower .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\norwegian hardcore hot (!) boobs lady (Britney,Ashley).zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\animal hidden titts sm (Sylvia,Melissa).rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\italian handjob horse full movie upskirt (Jade).zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Program Files\DVD Maker\Shared\german gay masturbation hairy .mpg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\cumshot several models femdom (Sarah).zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Program Files (x86)\Common Files\microsoft shared\spanish fetish masturbation girly (Tatjana,Liz).rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\hardcore lesbian licking titts .mpg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\tyrkish trambling cumshot [free] .mpg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\Temp\beast lingerie full movie girly .mpg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\beastiality hot (!) vagina young .mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\nude voyeur black hairunshaved .zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\trambling fetish girls (Curtney,Ashley).avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\blowjob animal hot (!) YEâPSè& .mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\african trambling beastiality uncut boobs fishy .zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\horse gang bang uncut balls .zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\british horse porn catfight glans .zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\german porn sperm licking vagina .mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\assembly\temp\nude hidden hotel .zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\PLA\Templates\asian hardcore animal [free] .zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\danish gang bang gay [bangbus] glans .mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\InstallTemp\russian nude hidden .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\black horse lesbian hidden .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\assembly\tmp\horse porn public ash leather .mpg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\SoftwareDistribution\Download\action bukkake hot (!) leather .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\indian fucking hidden .mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\swedish kicking kicking [milf] .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\spanish action horse voyeur ìï .zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\african gang bang girls legs (Ashley,Britney).mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\xxx beast public hole beautyfull .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\french handjob voyeur glans lady .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\italian fetish trambling lesbian 50+ .avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\Downloaded Program Files\lesbian licking mistress .zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\brasilian hardcore girls boots .mpg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\russian hardcore sleeping cock YEâPSè& (Janette,Sylvia).zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\japanese nude horse big mistress .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\african kicking catfight boots .zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\british animal fetish voyeur .avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\lingerie handjob [free] cock .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\animal big (Sylvia,Sylvia).avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\russian cum fetish uncut vagina shower .mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\horse porn [milf] tÛ .mpg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\asian animal lesbian glans .zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\tyrkish handjob hot (!) leather .zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\swedish kicking horse licking (Liz,Kathrin).mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\french kicking blowjob big gorgeoushorny .mpg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\asian gay sperm masturbation mistress .avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\german sperm gang bang girls .mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\fucking hardcore big young (Melissa,Ashley).zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\gay licking vagina boots (Liz).rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\african porn [milf] boobs (Liz).rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\british xxx voyeur mistress (Jenna).zip.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\kicking xxx several models hotel (Sylvia,Tatjana).rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\fetish kicking masturbation legs .mpg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\gang bang uncut nipples (Janette,Curtney).rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\action catfight hairy (Tatjana).mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\spanish trambling voyeur gorgeoushorny .avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\canadian animal trambling hidden ash bondage (Ashley).mpg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\canadian bukkake full movie redhair .avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\russian gay fucking several models .avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\tyrkish lesbian [bangbus] glans .mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\japanese kicking [milf] .avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\tyrkish sperm blowjob [milf] beautyfull .mpg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\danish lesbian porn girls cock shower (Sandy).avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\french cum xxx catfight beautyfull (Sonja,Anniston).avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\fucking cum [free] .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\fucking blowjob big sm .mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\horse public leather .avi.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\norwegian beast hardcore voyeur swallow .mpeg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\tyrkish horse big hole wifey .mpg.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\sperm public girly .rar.exe 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2584 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 2736 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2556 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 28 PID 2656 wrote to memory of 2556 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 28 PID 2656 wrote to memory of 2556 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 28 PID 2656 wrote to memory of 2556 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 28 PID 2656 wrote to memory of 2736 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 29 PID 2656 wrote to memory of 2736 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 29 PID 2656 wrote to memory of 2736 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 29 PID 2656 wrote to memory of 2736 2656 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 29 PID 2556 wrote to memory of 2584 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 30 PID 2556 wrote to memory of 2584 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 30 PID 2556 wrote to memory of 2584 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 30 PID 2556 wrote to memory of 2584 2556 470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe"C:\Users\Admin\AppData\Local\Temp\470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe"C:\Users\Admin\AppData\Local\Temp\470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe"C:\Users\Admin\AppData\Local\Temp\470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2584
-
-
-
C:\Users\Admin\AppData\Local\Temp\470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe"C:\Users\Admin\AppData\Local\Temp\470cab08c02d6eb5cea56f31c5f0e1c12cc4ad8a607abe16431bbbbebc67da41.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5cc32bbc40777f28c0ec163ae5ec978a2
SHA196529d7b04e88fba73a8d8b2121562cef8099da8
SHA256ca19c8c7445a44c8645c45beb71bfd27152ba420b7d4c5403637ee8f626edb82
SHA51201c88c5287a66701fad31597e5f482685787493421fa46004aceda566364d1dacdb2acc6d8939e7fe87a08271d5f0a3fb4f3d275d0a85dca9c5d231bbb426a13
-
Filesize
183B
MD5460dde241b184effe1d807dff448a760
SHA1628e28743d1433932e9829bb38ac7b83214505e8
SHA256ab2e378f4b17e9edc8bb21a7d575f2252aed4f58416eac47b50d43d1ec42ff2f
SHA512dd3dd3b5817c5e9a1ce58ef40ac4846c8b4a19b9a524d2fddf913aeab7d646394fa6a234af49e9399245dffd192ac1fd3c63fbe20e8c70149a4ccd9f93418951