Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 22:17
Behavioral task
behavioral1
Sample
6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe
Resource
win10v2004-20240419-en
General
-
Target
6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe
-
Size
113KB
-
MD5
580b5cc23aa39cdd0bfbcaa1ed878524
-
SHA1
122830fe99dc3657e9ee581085f52b949a8f1279
-
SHA256
6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e
-
SHA512
d6d6e9fb320ca3e9f5e7b308ed74f0acdeb4fd60e9a822faf0c729845f5fa4237a4140b287c26e899897d5a53f93cf3ab6015972f583e687c3dda10617ae05b1
-
SSDEEP
3072:wvs4dDXEGCLElS1Tj4mYWR/R4nkPR/1aVuyJrWnTa2LkMtcI:sPDLCL9Io5R4nM/40yJqnO2IM+I
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral1/files/0x0007000000014fe1-6.dat UPX behavioral1/memory/2180-99-0x0000000004ED0000-0x0000000004EEC000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2180-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2180-5-0x0000000004AC0000-0x0000000004ADC000-memory.dmp upx behavioral1/files/0x0007000000014fe1-6.dat upx behavioral1/memory/1268-7-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1268-33-0x0000000000860000-0x000000000087C000-memory.dmp upx behavioral1/memory/2180-93-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2180-95-0x0000000004AC0000-0x0000000004ADC000-memory.dmp upx behavioral1/memory/2180-99-0x0000000004ED0000-0x0000000004EEC000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\H: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\I: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\J: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\N: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\P: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\Q: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\S: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\U: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\Y: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\A: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\E: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\K: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\O: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\R: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\V: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\B: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\M: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\W: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\Z: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\G: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\L: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File opened (read-only) \??\X: 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\russian horse hardcore [free] glans ejaculation .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\SysWOW64\IME\shared\blowjob [milf] feet Ôë .avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\british xxx big .avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\SysWOW64\FxsTmp\tyrkish action gay licking titts (Gina,Tatjana).rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\SysWOW64\config\systemprofile\danish beastiality xxx [milf] hole stockings .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian fetish lesbian voyeur .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian cum xxx public stockings .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\SysWOW64\IME\shared\sperm hidden .mpeg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\SysWOW64\FxsTmp\norwegian trambling lesbian titts femdom (Karin).rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\SysWOW64\config\systemprofile\indian action bukkake [bangbus] .avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\tyrkish porn lesbian catfight titts .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\xxx girls black hairunshaved .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Program Files (x86)\Google\Temp\sperm uncut granny .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\russian animal blowjob girls cock boots (Samantha).avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Program Files (x86)\Microsoft Office\Templates\russian animal blowjob public latex .mpeg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\bukkake [bangbus] pregnant .mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Program Files\Windows Journal\Templates\tyrkish horse lingerie big (Jade).avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\danish porn fucking sleeping hole .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Program Files (x86)\Google\Update\Download\tyrkish nude blowjob public sweet .avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\danish kicking xxx lesbian (Sarah).mpeg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\indian cum sperm [bangbus] blondie .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Program Files\Common Files\Microsoft Shared\fucking [free] ash .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Program Files\DVD Maker\Shared\bukkake full movie .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\lingerie [bangbus] balls .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\tyrkish cum xxx hidden gorgeoushorny .mpeg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\hardcore hidden .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\brasilian nude gay [bangbus] glans sm .mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\horse big hole .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\nude sperm voyeur (Sylvia).rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\british hardcore several models hole femdom .mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\italian cum lesbian girls 50+ (Gina,Karin).mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\assembly\tmp\xxx [milf] feet .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\cum beast lesbian glans (Christine,Sylvia).mpeg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\malaysia lingerie girls feet .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\russian porn fucking masturbation YEâPSè& .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\black handjob lesbian hot (!) shoes .mpeg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\swedish fetish horse public boots .avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\sperm hidden fishy (Sonja,Sarah).mpeg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\spanish sperm sleeping 50+ .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\asian lingerie sleeping .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\italian horse xxx big .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\sperm sleeping .mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\horse hidden cock (Sonja,Samantha).mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\indian cum sperm [free] cock beautyfull (Sylvia).avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\spanish lingerie uncut hairy .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\american porn sperm sleeping stockings .mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\tyrkish gang bang beast masturbation mature .mpeg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\brasilian gang bang blowjob catfight .mpeg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\porn lesbian voyeur wifey .mpeg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\cumshot trambling hot (!) feet high heels .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\fetish lesbian hidden hole .mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\indian horse sperm girls .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\brasilian horse blowjob [free] glans stockings .mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\british hardcore big (Sarah).zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\danish cumshot lesbian lesbian mistress .mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\mssrv.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\italian handjob beast uncut titts sm .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\lingerie sleeping (Melissa).zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\action hardcore big swallow .mpeg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\brasilian porn lingerie big feet .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\asian bukkake voyeur hotel .mpeg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\lingerie uncut .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\japanese horse blowjob hot (!) (Sylvia).rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\black handjob fucking hot (!) .avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\InstallTemp\beastiality gay lesbian cock gorgeoushorny (Janette).zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\action bukkake public titts .mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\danish nude bukkake hot (!) titts pregnant .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\security\templates\bukkake [milf] glans black hairunshaved .mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\porn xxx [milf] leather .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\sperm hot (!) (Jade).mpeg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\spanish lesbian full movie mistress (Ashley,Jade).avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\kicking lesbian masturbation .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\asian fucking girls sm .avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\bukkake masturbation sm .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\danish action fucking big circumcision .rar.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\beastiality bukkake uncut ìï .mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\french horse sleeping (Melissa).mpeg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\british hardcore hot (!) cock redhair .avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\Temp\black gang bang xxx [bangbus] shoes .avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\spanish xxx [free] titts lady .avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\indian handjob lingerie several models hole (Anniston,Curtney).zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\gay hidden lady .mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\french blowjob lesbian .mpg.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\animal beast [bangbus] glans ìï .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\fetish fucking [free] 50+ .avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\kicking trambling [free] .avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\horse fucking full movie .avi.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\brasilian nude sperm masturbation shower .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\hardcore several models feet .zip.exe 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2940 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 2864 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1268 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 28 PID 2180 wrote to memory of 1268 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 28 PID 2180 wrote to memory of 1268 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 28 PID 2180 wrote to memory of 1268 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 28 PID 2180 wrote to memory of 2864 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 29 PID 2180 wrote to memory of 2864 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 29 PID 2180 wrote to memory of 2864 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 29 PID 2180 wrote to memory of 2864 2180 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 29 PID 1268 wrote to memory of 2940 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 30 PID 1268 wrote to memory of 2940 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 30 PID 1268 wrote to memory of 2940 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 30 PID 1268 wrote to memory of 2940 1268 6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe"C:\Users\Admin\AppData\Local\Temp\6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe"C:\Users\Admin\AppData\Local\Temp\6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe"C:\Users\Admin\AppData\Local\Temp\6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2940
-
-
-
C:\Users\Admin\AppData\Local\Temp\6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe"C:\Users\Admin\AppData\Local\Temp\6c2f452c37bd510a856f96bc889df7f8ec4a6306d52b90fb8b0cbc3c998c6b4e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2864
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD576c919deec91df22d480ed9270735abe
SHA17ab6015c641453d3f7fe17c97494396467b0d465
SHA2564465fba80775a20d2e4f50da02ebe853945869d655cc695ac1a3604e1f0d380f
SHA512542c816a49670627c1b6a5759a3d3d15fb66a89a4ca9fe58b0edd71d58b94c168cab3fa87a0b3b4321ba01fd42f19ff3e532f12aec90d8a15429fc9281d00e6c
-
Filesize
183B
MD5f4c2d35deba4fef6e2425a6af3f43d36
SHA1f3df8edb8e6d4527fa1486dc203114710c922335
SHA2569509b05f6bf023bab215066f5864a23eeaedddf42e4c89b9872e682d007a99a3
SHA512426c730618c61f73082ceeeb4b34ace760d930d853ae9122dae8224fad6b56f35dda6c3ab7c74e1ebc2b5c36079dc73053ccacff6bfe6225c4edcb7a69138ab1