5c2b0e035f477e5a2e3ddff5ca746723993af0f2c9e1b77cd911048d8a09d37d

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05d4949f5566cac3c9a7d327904e2603.exe
Size

1.9MB
MD5

05d4949f5566cac3c9a7d327904e2603
SHA1

2d4a5106bb8fe7e81439c4f1a6b2101efc966239
SHA256

5c2b0e035f477e5a2e3ddff5ca746723993af0f2c9e1b77cd911048d8a09d37d
SHA512

666dedf53270ed5d1076be1adf8e416df9971c246bc719ad861e5d193446c7cca5faa9efb7b2aecfae700caeabd31367c6bd3f3f991d67e872a0c5a95f1b093b
SSDEEP

49152:+OhyHMTt08QU+3gEg81yIKL3NhI+3Yoi4XT6+/I3Gu:+OMktT+3E8oIKH31XTfMx

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2184-0-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x0007000000014251-5.dat	upx
behavioral1/memory/2460-63-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2960-92-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2184-94-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2460-97-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2960-106-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2184-107-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2184-112-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2184-115-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2184-118-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2184-123-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2184-126-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2184-129-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2184-132-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2184-135-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2184-138-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2184-141-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2184-144-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2184-147-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	05d4949f5566cac3c9a7d327904e2603.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\B:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\E:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\G:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\Q:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\R:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\S:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\I:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\J:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\N:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\O:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\T:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\W:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\H:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\L:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\U:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\Z:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\A:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\K:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\M:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\P:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\V:	05d4949f5566cac3c9a7d327904e2603.exe
File opened (read-only)	\??\X:	05d4949f5566cac3c9a7d327904e2603.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FxsTmp\british action hidden traffic .mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\action nude voyeur (Ashley,Liz).zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\SysWOW64\config\systemprofile\swedish beast lingerie public feet traffic .avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\SysWOW64\IME\shared\american fetish fucking lesbian 50+ .avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\handjob girls glans traffic .mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\System32\DriverStore\Temp\italian cum big titts .mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\japanese horse lingerie full movie hotel .rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\SysWOW64\FxsTmp\brasilian lesbian [bangbus] (Sandy).mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\SysWOW64\config\systemprofile\fetish catfight .mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\SysWOW64\IME\shared\italian beast hot (!) vagina .mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Journal\Templates\black action [bangbus] hotel .mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\asian bukkake public (Kathrin,Anniston).rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Program Files\DVD Maker\Shared\danish porn porn sleeping penetration .zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\brasilian blowjob [milf] gorgeoushorny (Samantha).avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\african blowjob bukkake several models shower .mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\german action sleeping latex (Liz,Liz).zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\beastiality handjob [bangbus] .mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\chinese horse handjob catfight young .mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\beastiality catfight .avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\trambling hidden stockings .avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Program Files (x86)\Google\Temp\italian beast xxx catfight glans (Gina,Anniston).mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Program Files (x86)\Google\Update\Download\russian handjob kicking girls 50+ .rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\german action lesbian full movie hotel .zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\german trambling hidden nipples (Britney,Sonja).avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Program Files\Common Files\Microsoft Shared\xxx blowjob masturbation swallow .mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\norwegian beastiality cumshot sleeping cock .rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\american gay [free] fishy .zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\beastiality animal public blondie .rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\german horse animal lesbian high heels .avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\brasilian beastiality lingerie voyeur .avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\fetish gay big bedroom .avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\black cumshot horse masturbation .rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\InstallTemp\norwegian fetish hidden .mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\animal several models boobs 50+ .mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\cumshot catfight .mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\brasilian lesbian hardcore several models lady .mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\fucking masturbation .rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\brasilian sperm girls ìï .mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\indian bukkake [free] ash .avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\gay cum full movie boobs femdom .mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\sperm blowjob hidden .zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\handjob hardcore lesbian granny .mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\fetish gay big .mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\hardcore [milf] .zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\Downloaded Program Files\danish kicking uncut blondie .mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\SoftwareDistribution\Download\kicking several models feet (Karin).mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\lingerie animal girls traffic .zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\lingerie porn girls circumcision .zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\lingerie lesbian .rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\animal [bangbus] titts traffic .mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\swedish hardcore beastiality several models titts (Curtney,Sandy).zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\danish kicking handjob sleeping (Sonja).mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\african animal xxx lesbian bedroom .mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\malaysia fetish lesbian [bangbus] hole granny (Liz,Tatjana).mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\assembly\tmp\gang bang voyeur shoes .zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\french action licking (Tatjana).mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\animal [bangbus] glans castration (Karin,Janette).avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\lingerie blowjob [bangbus] 50+ .avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\canadian fucking hardcore hot (!) .rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\mssrv.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\PLA\Templates\black fetish gay full movie .avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\malaysia cum handjob hidden hole high heels .zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\cumshot cumshot girls shower (Janette).zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\african cumshot girls .zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\african lesbian beastiality sleeping bondage (Sylvia).mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\asian cum nude girls .mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\beast handjob girls shoes .mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\gang bang masturbation cock (Sandy).zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\italian bukkake public ash (Sonja).rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\italian nude sleeping castration .avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\spanish nude public latex (Sonja,Jenna).mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\Temp\japanese hardcore lingerie full movie redhair .mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\lingerie hardcore [milf] high heels .mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\hardcore public beautyfull (Samantha,Gina).avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\russian blowjob [milf] redhair (Tatjana).mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\horse several models blondie .rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\asian horse handjob hidden .avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\cum uncut .zip.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\brasilian beast hardcore uncut black hairunshaved .rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\handjob big .rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\british gang bang cumshot licking boobs .mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\horse several models cock femdom .avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\gay bukkake catfight .mpeg.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\german cum cum several models stockings (Sylvia,Christine).rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\british cum voyeur boobs (Sonja).avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\african hardcore hot (!) (Sarah).rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\animal beast full movie (Melissa,Liz).avi.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\tyrkish horse porn voyeur .rar.exe	05d4949f5566cac3c9a7d327904e2603.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\german fucking lesbian sleeping girly .mpg.exe	05d4949f5566cac3c9a7d327904e2603.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe
2184	05d4949f5566cac3c9a7d327904e2603.exe
2460	05d4949f5566cac3c9a7d327904e2603.exe
2960	05d4949f5566cac3c9a7d327904e2603.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2460	2184	05d4949f5566cac3c9a7d327904e2603.exe	28
PID 2184 wrote to memory of 2460	2184	05d4949f5566cac3c9a7d327904e2603.exe	28
PID 2184 wrote to memory of 2460	2184	05d4949f5566cac3c9a7d327904e2603.exe	28
PID 2184 wrote to memory of 2460	2184	05d4949f5566cac3c9a7d327904e2603.exe	28
PID 2460 wrote to memory of 2960	2460	05d4949f5566cac3c9a7d327904e2603.exe	29
PID 2460 wrote to memory of 2960	2460	05d4949f5566cac3c9a7d327904e2603.exe	29
PID 2460 wrote to memory of 2960	2460	05d4949f5566cac3c9a7d327904e2603.exe	29
PID 2460 wrote to memory of 2960	2460	05d4949f5566cac3c9a7d327904e2603.exe	29

C:\Users\Admin\AppData\Local\Temp\05d4949f5566cac3c9a7d327904e2603.exe
"C:\Users\Admin\AppData\Local\Temp\05d4949f5566cac3c9a7d327904e2603.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\05d4949f5566cac3c9a7d327904e2603.exe
  "C:\Users\Admin\AppData\Local\Temp\05d4949f5566cac3c9a7d327904e2603.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Users\Admin\AppData\Local\Temp\05d4949f5566cac3c9a7d327904e2603.exe
    "C:\Users\Admin\AppData\Local\Temp\05d4949f5566cac3c9a7d327904e2603.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\asian bukkake public (Kathrin,Anniston).rar.exe

Filesize
1.5MB

MD5
caf6fe0644516c411a35cbd90089655a

SHA1
1694c68ba9bc67513737e307fefe35b368e71b65

SHA256
4f9495991ebd7146b9de4e67791f720c1888f3fd7a8fc4f7dab6b931cc9856a6

SHA512
23f505841011ee441720ce64a217569da1d45482dfdc093168d8859de3b3557d33b591a5d52de5c91ea5a8cc444cb1e558972683337099be181d6c3f726de7f1

Download Submit
memory/2184-112-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2184-129-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2184-62-0x0000000004D60000-0x0000000004D7B000-memory.dmp

Filesize
108KB

Download
memory/2184-147-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2184-144-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2184-94-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2184-141-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2184-115-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2184-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2184-110-0x0000000004D60000-0x0000000004D7B000-memory.dmp

Filesize
108KB

Download
memory/2184-138-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2184-107-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2184-135-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2184-118-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2184-123-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2184-126-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2184-132-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2460-111-0x0000000004AA0000-0x0000000004ABB000-memory.dmp

Filesize
108KB

Download
memory/2460-63-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2460-97-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2460-91-0x0000000004AA0000-0x0000000004ABB000-memory.dmp

Filesize
108KB

Download
memory/2960-106-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2960-92-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download