b9c1e002158f5c39b8057507c27438c96c813bf6f919846ac00ab711105a9133

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
Size

1.7MB
MD5

4ea9534b56697202c026ac4bd85eb690
SHA1

0bc62bb2883c66e3d3189bd62c7b1ff58c432719
SHA256

b9c1e002158f5c39b8057507c27438c96c813bf6f919846ac00ab711105a9133
SHA512

f1d9c0e62cc4fe1f6ea0425cc5ddfc7300fe2d956fba5d5519bbce22eca1fed8111789aaeb2b9ab3c1a3855796bde8d8f248aa1549eff06885f9f61a39071c9a
SSDEEP

24576:A8vtTau+cM42rUymcpXJOYpqFz57sGe1QPhpjxsggyIS9J3fx0Ep0hOBQEg8:AktGu+hTQaOsqMQJdNgU9J3fYIBQEl

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2968-0-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x0007000000016c7c-5.dat	upx
behavioral1/memory/2516-68-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2152-91-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2968-95-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2516-104-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2152-105-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2968-106-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2968-111-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2968-114-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2968-117-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2968-122-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2968-125-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2968-128-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2968-131-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2968-134-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2968-137-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2968-140-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2968-143-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2968-146-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\R:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\S:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\T:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\X:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\H:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\I:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\L:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\U:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\E:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\N:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\O:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\J:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\W:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\K:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\M:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\Q:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\V:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\Y:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\A:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\B:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\G:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File opened (read-only)	\??\Z:	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\danish kicking lingerie [milf] hole bedroom (Liz).avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\SysWOW64\FxsTmp\animal lesbian full movie bondage .mpeg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian nude beast uncut circumcision .avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\SysWOW64\FxsTmp\danish action fucking sleeping feet .mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\SysWOW64\IME\shared\lingerie [milf] glans .mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\SysWOW64\config\systemprofile\tyrkish cumshot bukkake [bangbus] high heels .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\american kicking bukkake [milf] glans .zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\SysWOW64\IME\shared\hardcore voyeur titts sm (Janette).rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\bukkake lesbian leather .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\SysWOW64\config\systemprofile\american cumshot lingerie big YEâPSè& .mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\gay [free] penetration .mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\italian handjob horse masturbation pregnant .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Program Files\Windows Journal\Templates\tyrkish action fucking [milf] leather .avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\lingerie big (Jade).mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\tyrkish beastiality horse lesbian titts .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Program Files\DVD Maker\Shared\swedish horse blowjob sleeping .avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Program Files (x86)\Google\Temp\american animal fucking [milf] feet 50+ (Samantha).zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Program Files (x86)\Google\Update\Download\brasilian cum bukkake [free] (Liz).mpeg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\italian kicking fucking sleeping feet beautyfull .zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\blowjob lesbian traffic .mpeg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\indian cumshot horse [bangbus] 50+ .zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\danish horse horse [milf] beautyfull (Ashley,Jade).mpeg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\tyrkish porn horse sleeping 50+ .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\indian kicking bukkake [free] feet .avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\bukkake lesbian .avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\InstallTemp\nude fucking lesbian feet leather .avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\xxx hidden feet black hairunshaved .avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\kicking horse several models mature .mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\swedish horse sperm sleeping blondie .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\french gay masturbation cock femdom (Sylvia).zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\african horse public .avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\brasilian porn trambling uncut (Janette).avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\danish animal sperm masturbation hole upskirt .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\indian fetish bukkake catfight .zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\xxx catfight femdom .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\italian beastiality fucking licking hole ìï .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\canadian lingerie hidden glans high heels .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\asian lesbian [bangbus] hairy .mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\handjob blowjob uncut ìï (Jenna,Melissa).mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\horse lesbian redhair (Gina,Janette).avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\lesbian [bangbus] hole .zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\chinese blowjob licking (Curtney).zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\handjob fucking masturbation .zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\assembly\tmp\lingerie hidden titts mature (Sylvia).mpeg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\danish beastiality lingerie voyeur girly .avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\african lesbian several models feet .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\kicking beast [bangbus] 40+ .avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\american kicking xxx big cock (Kathrin,Jade).avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\animal fucking hot (!) fishy .mpeg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\blowjob voyeur cock (Christine,Samantha).rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\italian beastiality blowjob lesbian sweet .zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\lesbian hot (!) hotel .mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\action lingerie masturbation hotel .mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\sperm sleeping titts .mpeg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\mssrv.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\xxx voyeur feet 40+ (Sarah).avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\malaysia sperm hidden titts lady (Liz).mpeg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\fetish horse uncut .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\japanese gang bang lesbian [milf] hole 40+ .zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\canadian lingerie hidden ejaculation .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\american kicking horse public titts .zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\american kicking blowjob lesbian young .mpeg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\american nude sperm catfight (Janette).mpeg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\blowjob [bangbus] glans 50+ .mpeg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\blowjob big hole .zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\french beast lesbian cock .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\japanese handjob trambling sleeping .mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\lesbian sleeping feet .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\Downloaded Program Files\brasilian handjob horse hot (!) ejaculation .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\spanish hardcore public .avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\trambling full movie traffic .mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\tyrkish horse hardcore big .mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\fucking lesbian .zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\german bukkake full movie (Sarah).zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\xxx [bangbus] titts blondie .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\japanese gang bang fucking uncut 50+ (Britney,Curtney).avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\horse beast voyeur cock .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\tyrkish cum lingerie public hairy .zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\african horse lesbian .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\german beast [milf] upskirt .zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\gay licking femdom (Britney,Tatjana).zip.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\brasilian porn sperm [milf] hole 40+ .mpeg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\black nude lingerie hot (!) femdom (Sonja,Jade).rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\black action lesbian uncut feet 40+ .mpeg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\japanese porn hardcore uncut shower (Britney,Tatjana).avi.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\tyrkish beastiality sperm sleeping feet 50+ .rar.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\fucking uncut femdom .mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\asian gay sleeping lady .mpeg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\french hardcore [bangbus] glans .mpg.exe	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
2152	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2516	2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe	28
PID 2968 wrote to memory of 2516	2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe	28
PID 2968 wrote to memory of 2516	2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe	28
PID 2968 wrote to memory of 2516	2968	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe	28
PID 2516 wrote to memory of 2152	2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe	29
PID 2516 wrote to memory of 2152	2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe	29
PID 2516 wrote to memory of 2152	2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe	29
PID 2516 wrote to memory of 2152	2516	4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\lingerie big (Jade).mpg.exe

Filesize
2.0MB

MD5
1419a498befc67da5bffd83195670c1f

SHA1
5fc95bfab2441d01434b0ad305ebdbee73d10461

SHA256
ce86106bf5ad82bee808bd5ee53f196fa4c2955da49dbcdf2ee18eaf1d9a4fc0

SHA512
7431c8585fc8a9817420cdfb521d84d495aab138f76ada65de40978758e3a6f77137c5268db5f127bfaccba4293a27b229b42d3d41d4ab6f2935e5e071acf76b

Download Submit
C:\debug.txt

Filesize
183B

MD5
86de8b9688607a9d1b0fb2da9c35a767

SHA1
3fd8ceba362067ff51299942139971aca66ee816

SHA256
01d7907c7f4386bafab09fa1882f17a82164fec9edfd9d29ebb0bd37394f254d

SHA512
dd32f40372a8e1c19f05ca18a27b1fb63157040c98149c6f6fdea3e6cddf864d45d38f4a4827623500a0085433af654efb854597f5262885756163846ae3ff45

Download Submit
memory/2152-91-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2152-105-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2516-104-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2516-68-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2516-110-0x0000000004CD0000-0x0000000004CEC000-memory.dmp

Filesize
112KB

Download
memory/2516-90-0x0000000004CD0000-0x0000000004CEC000-memory.dmp

Filesize
112KB

Download
memory/2968-95-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-125-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-106-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-109-0x0000000005AC0000-0x0000000005ADC000-memory.dmp

Filesize
112KB

Download
memory/2968-67-0x0000000005AC0000-0x0000000005ADC000-memory.dmp

Filesize
112KB

Download
memory/2968-111-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-114-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-117-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-122-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-128-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-131-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-134-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-137-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-140-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-143-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-146-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download