Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 05:00
Behavioral task
behavioral1
Sample
fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe
Resource
win10v2004-20240412-en
General
-
Target
fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe
-
Size
92KB
-
MD5
6333a1be3240aa3d320f34d05a16a337
-
SHA1
f9a95c39a0831afbe7ff0b4715931c4419ee6abb
-
SHA256
fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67
-
SHA512
b6eba9dfeb14efe093f1f402f1078a628f4170854b5442330851cbedac398af057195a0c8f4273a1d62ae7c233c5cae217326f80a5ea8a7c413784b44da8971d
-
SSDEEP
1536:cGRVCaKgzbLc54hukfgvYnouy8kV1Ayj4m/QWR/Rlq88vlnRqPR/1aViDRknJM2o:cGjbLl/gvQoutY1Tj4mYWR/R4nkPR/1h
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 5 IoCs
resource yara_rule behavioral1/memory/2228-82-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2764-92-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2036-109-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2228-112-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2764-114-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 8 IoCs
resource yara_rule behavioral1/memory/2036-0-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral1/files/0x000700000001418d-5.dat UPX behavioral1/memory/2228-82-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral1/memory/2764-92-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral1/memory/2036-109-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral1/memory/2036-111-0x0000000005720000-0x000000000573D000-memory.dmp UPX behavioral1/memory/2228-112-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral1/memory/2764-114-0x0000000000400000-0x000000000041D000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2036-0-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/files/0x000700000001418d-5.dat upx behavioral1/memory/2228-82-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2764-92-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2036-109-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2036-111-0x0000000005720000-0x000000000573D000-memory.dmp upx behavioral1/memory/2228-112-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2764-114-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\T: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\W: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\Y: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\Z: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\B: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\I: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\N: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\M: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\S: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\L: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\A: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\H: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\J: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\O: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\P: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\R: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\U: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\V: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\E: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\G: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\K: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File opened (read-only) \??\X: fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\horse public (Jade).avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\System32\DriverStore\Temp\indian handjob fucking hidden (Jade).zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\SysWOW64\FxsTmp\spanish bukkake [milf] (Curtney).mpg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\SysWOW64\FxsTmp\bukkake voyeur (Samantha).rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish beastiality blowjob uncut leather .mpg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\SysWOW64\IME\shared\sperm sleeping 50+ .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\tyrkish action gay big (Karin).mpg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\SysWOW64\config\systemprofile\xxx full movie glans .zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\swedish handjob sperm masturbation boots .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\SysWOW64\IME\shared\japanese animal horse [milf] feet beautyfull .mpg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Update\Download\danish fetish sperm catfight .rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\black cum xxx [free] glans hotel .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\american animal hardcore [bangbus] feet .rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Program Files\Common Files\Microsoft Shared\hardcore [bangbus] hole granny (Sylvia).avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Program Files\DVD Maker\Shared\swedish cum hardcore masturbation glans ejaculation (Karin).mpg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Program Files\Windows Journal\Templates\russian horse blowjob full movie .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\japanese handjob horse masturbation .zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\brasilian fetish trambling several models titts .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\tyrkish cum lesbian [free] (Janette).mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Program Files (x86)\Microsoft Office\Templates\japanese kicking hardcore voyeur glans penetration .mpg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Program Files (x86)\Google\Temp\trambling [bangbus] .rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\bukkake [free] young .rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\danish porn lesbian sleeping glans (Britney,Melissa).mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\hardcore uncut hole .mpg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Program Files (x86)\Common Files\microsoft shared\italian gang bang lesbian hidden glans ash (Janette).zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\french gay licking cock beautyfull .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\cumshot lesbian [milf] .rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\malaysia blowjob catfight (Samantha).avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\assembly\tmp\danish gang bang bukkake voyeur feet granny .zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\russian beastiality sperm public hole .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\horse trambling [free] bondage .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\xxx hot (!) hole hotel (Sylvia).mpg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\Downloaded Program Files\japanese beastiality lingerie masturbation shower .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\black kicking lesbian several models titts shower (Samantha).mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\german sperm lesbian granny (Jenna,Sylvia).zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\handjob lingerie big (Sylvia).rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\danish handjob lingerie hot (!) titts .mpg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\SoftwareDistribution\Download\sperm girls .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\horse lesbian hidden glans ash .rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\malaysia gay licking ìï .rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\african lesbian several models glans .rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\assembly\temp\indian nude beast uncut (Sarah).zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\tyrkish kicking hardcore [bangbus] feet sweet .rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\malaysia fucking uncut cock .rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\lingerie [free] titts mature (Jade).avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\gay voyeur titts black hairunshaved .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\gay [bangbus] latex .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\spanish trambling voyeur penetration .zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\Temp\black cum blowjob [milf] (Jade).rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\black gang bang lesbian licking swallow .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\french bukkake catfight penetration .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\black kicking xxx big redhair .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\handjob xxx [free] mistress (Anniston,Samantha).rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\security\templates\russian beastiality gay licking .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\blowjob sleeping titts beautyfull .zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\asian horse big (Melissa).zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\InstallTemp\canadian lesbian big hole (Christine,Curtney).mpg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\sperm lesbian wifey .zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\chinese lesbian [bangbus] latex .zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\fucking hot (!) sm .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\british sperm sleeping feet (Ashley,Sylvia).rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\cumshot sperm lesbian glans gorgeoushorny (Tatjana).mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\brasilian nude gay [milf] glans bedroom .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\gang bang horse [bangbus] mistress .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\nude gay licking .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\gay hot (!) hairy .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\fetish beast sleeping titts latex .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\russian cum lingerie [free] titts mature .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\tyrkish animal sperm [milf] glans castration (Janette).mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\chinese hardcore public black hairunshaved .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\swedish horse xxx [bangbus] feet 50+ .zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\asian xxx [bangbus] hole .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\canadian blowjob full movie redhair .mpg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\italian fetish lesbian full movie blondie (Ashley,Samantha).zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\lesbian girls high heels .rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\beast uncut granny .zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\russian cumshot lesbian lesbian .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\spanish trambling voyeur cock ejaculation .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\french lesbian big hole high heels (Tatjana).avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\spanish fucking [free] sm (Christine,Sarah).mpg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\animal gay lesbian .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\trambling girls lady .avi.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\tyrkish beastiality gay catfight (Liz).mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\mssrv.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\horse horse licking 40+ (Sonja,Jade).rar.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\PLA\Templates\japanese fetish horse girls swallow .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\tyrkish horse blowjob catfight cock penetration .mpg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\african sperm uncut titts granny .mpeg.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\bukkake big titts (Christine,Samantha).zip.exe fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 2764 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2228 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 28 PID 2036 wrote to memory of 2228 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 28 PID 2036 wrote to memory of 2228 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 28 PID 2036 wrote to memory of 2228 2036 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 28 PID 2228 wrote to memory of 2764 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 29 PID 2228 wrote to memory of 2764 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 29 PID 2228 wrote to memory of 2764 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 29 PID 2228 wrote to memory of 2764 2228 fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe"C:\Users\Admin\AppData\Local\Temp\fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe"C:\Users\Admin\AppData\Local\Temp\fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe"C:\Users\Admin\AppData\Local\Temp\fce39de768eb8e72aa107ae9c53348dc50d2a5025633f068d1d7f7414b204e67.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2764
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Sidebar\Shared Gadgets\danish porn lesbian sleeping glans (Britney,Melissa).mpeg.exe
Filesize365KB
MD5f081f5e7b5abdb7ee2e2c556fc315eca
SHA10301a87979b8545360318325202ddd8a15c5c83f
SHA256565f9168400bae451b11b8d6cf0ff5a60e18c970bc94a46a0dd0e9f968409bde
SHA51250f31d14e7d244875215f8caa6a16149c85bd7cabd670f0c903c57b72df9b691517ddfa3ea3583f13446a077a0613cbe68c9ca834920e56197b70dd0d29fdb23