Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 21:54
Behavioral task
behavioral1
Sample
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe
Resource
win10v2004-20240508-en
General
-
Target
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe
-
Size
91KB
-
MD5
4b5d6d18cda1866b0f43584ad800e853
-
SHA1
61d9f0de03e415853d000f20a5f4df5d485e5b9f
-
SHA256
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0
-
SHA512
d83282a47f507275af5e89c39914d5b66c81c2346f7a7968ffa91dcf80f64e7a2ef7ea34eb6e3d5220d7f3fbf9a7652ddda899a54dc1e43097f71a1be889dacb
-
SSDEEP
1536:xRVCaKgzbLc54hukfgvYnouy8gbQHKo4NV1Ayj4m/QWR/Rlq88vlnRqPR/1+qZdq:bjbLl/gvQoutgbqKo4L1Tj4mYWR/R4nv
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2432-64-0x0000000000400000-0x0000000000429000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1736-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\Program Files\Windows Sidebar\Shared Gadgets\sperm [milf] mistress (Britney,Liz).rar.exe UPX behavioral1/memory/1736-14-0x0000000004C40000-0x0000000004C69000-memory.dmp UPX behavioral1/memory/2548-16-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2548-63-0x00000000047D0000-0x00000000047F9000-memory.dmp UPX behavioral1/memory/2432-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2876-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1736-0-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\Program Files\Windows Sidebar\Shared Gadgets\sperm [milf] mistress (Britney,Liz).rar.exe upx behavioral1/memory/1736-14-0x0000000004C40000-0x0000000004C69000-memory.dmp upx behavioral1/memory/2548-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-63-0x00000000047D0000-0x00000000047F9000-memory.dmp upx behavioral1/memory/2432-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-65-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exedescription ioc process File opened (read-only) \??\G: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\M: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\N: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\U: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\H: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\J: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\K: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\P: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\W: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\A: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\E: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\L: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\S: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\X: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\Y: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\Z: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\B: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\I: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\O: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\Q: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\R: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\T: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\V: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe -
Drops file in System32 directory 10 IoCs
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exedescription ioc process File created C:\Windows\SysWOW64\FxsTmp\gang bang fucking hidden beautyfull .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\IME\shared\xxx hidden mistress (Sandy,Janette).avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\lesbian sleeping cock .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\config\systemprofile\lingerie catfight .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\IME\shared\swedish nude sperm full movie glans lady (Curtney).zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\config\systemprofile\horse masturbation (Janette).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian cum xxx hot (!) hole .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\System32\DriverStore\Temp\italian animal blowjob lesbian glans 40+ .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\italian nude xxx masturbation titts .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\FxsTmp\indian gang bang bukkake catfight (Samantha).mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe -
Drops file in Program Files directory 15 IoCs
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exedescription ioc process File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\beast uncut titts pregnant (Sylvia).rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\brasilian kicking bukkake catfight titts leather .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\bukkake masturbation titts .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\tyrkish kicking beast [free] glans bedroom .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files\Windows Journal\Templates\sperm full movie feet (Anniston,Jade).avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\sperm [milf] mistress (Britney,Liz).rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Google\Update\Download\american kicking lingerie [milf] glans .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Microsoft Office\Templates\black cum beast catfight titts girly .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Google\Temp\trambling [milf] girly .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\russian porn bukkake public hole bedroom (Samantha).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Common Files\microsoft shared\black handjob sperm uncut hole latex .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\gay masturbation glans black hairunshaved .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files\Common Files\Microsoft Shared\black fetish xxx masturbation titts mature .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files\DVD Maker\Shared\russian cumshot horse girls (Melissa).avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\american gang bang trambling lesbian hole (Gina,Liz).avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe -
Drops file in Windows directory 64 IoCs
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exedescription ioc process File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\asian lingerie [free] glans 40+ (Curtney).rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\gang bang lingerie lesbian hole sm (Sarah).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\action hardcore uncut (Melissa).rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\russian horse sperm masturbation titts .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\InstallTemp\horse [free] .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\german xxx catfight feet femdom .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\french sperm public titts femdom (Melissa).rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\spanish bukkake licking young .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\porn hardcore lesbian (Samantha).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\french lesbian licking (Curtney).rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\norwegian trambling voyeur bedroom (Gina,Karin).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\trambling big femdom .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\japanese animal sperm public YEâPSè& (Kathrin,Sylvia).mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\japanese cum gay girls cock mistress (Melissa).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\norwegian beast public hole 40+ .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\canadian lingerie big stockings .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\lesbian hot (!) cock .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\gay hidden (Liz).rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\canadian blowjob big hole hotel .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\cum horse sleeping hole (Ashley,Tatjana).mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\lesbian masturbation hole .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\xxx uncut glans shoes (Janette).avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\lesbian licking titts pregnant (Janette).mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\assembly\tmp\blowjob sleeping bondage .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\swedish action xxx [free] hairy .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\british lesbian full movie .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\american nude beast hidden .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\kicking hardcore hidden hole .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\hardcore full movie redhair .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\horse catfight feet .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\swedish action xxx [bangbus] 50+ .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\french fucking catfight traffic .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\trambling hidden hole lady .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\tyrkish fetish sperm licking (Melissa).zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\security\templates\bukkake licking hole fishy .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\japanese action blowjob licking .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\chinese trambling masturbation YEâPSè& .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\german trambling lesbian titts .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\mssrv.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\danish cumshot sperm hidden cock stockings .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\fucking [free] glans latex .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\PLA\Templates\japanese fetish fucking several models (Sarah).avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\malaysia bukkake [milf] hole (Christine,Karin).mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\horse beast [milf] .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\african xxx big girly (Sandy,Jade).avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\black animal horse public .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\chinese xxx hidden cock blondie .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\black nude hardcore [bangbus] titts (Jenna,Melissa).avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\japanese nude lingerie [bangbus] granny .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\Downloaded Program Files\tyrkish nude hardcore public .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\italian cum beast uncut titts granny (Melissa).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\beast catfight .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\brasilian animal blowjob [free] .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\chinese sperm hidden sm .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\malaysia lesbian lesbian cock femdom .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\french lesbian lesbian upskirt .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\swedish handjob trambling sleeping .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\black beastiality horse lesbian lady .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\french hardcore hot (!) (Janette).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\trambling [bangbus] glans black hairunshaved .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\japanese beastiality xxx voyeur .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\horse sleeping feet .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\french horse girls .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\american animal lingerie catfight high heels .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exepid process 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2876 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2432 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exedescription pid process target process PID 1736 wrote to memory of 2548 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 1736 wrote to memory of 2548 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 1736 wrote to memory of 2548 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 1736 wrote to memory of 2548 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 2548 wrote to memory of 2432 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 2548 wrote to memory of 2432 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 2548 wrote to memory of 2432 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 2548 wrote to memory of 2432 2548 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 1736 wrote to memory of 2876 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 1736 wrote to memory of 2876 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 1736 wrote to memory of 2876 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 1736 wrote to memory of 2876 1736 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Sidebar\Shared Gadgets\sperm [milf] mistress (Britney,Liz).rar.exeFilesize
706KB
MD5a25671173a6015a9c72e142898f36e2a
SHA12a949b54114cc0e65a4f1b30af92f966be1bdef1
SHA2562deaff5aefa0b1c3b1b746890a772f59326ef3b69c85a98903621a329d040f2a
SHA51252bfda9fdab566fcc05768b5e5ad88732abc7242559d4115363a425fd40bdeadfdbbc8263d9cf63e79fa2a0ed24cd7b7005ad2f2ae9c0eb2fb535c2b069ef7df
-
C:\debug.txtFilesize
183B
MD59ef2895ff3b7dbaa2ece46ad623d9bf5
SHA18b2fba3a59582d2911af490644ea3e48ab238a26
SHA256f982293aeac4ea81a9ab8dccdd224f0fdef98f68842b9b020e1135c9043e1c7c
SHA5127d6d474b52f8a1e31b122db2d4e38fa002473ab8108e9e187be8af3b464a0fc520800ab65c759858ce7ae9283bb6bbef317f972da21a0796846368b79908a664
-
memory/1736-0-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1736-14-0x0000000004C40000-0x0000000004C69000-memory.dmpFilesize
164KB
-
memory/2432-64-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2548-16-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2548-63-0x00000000047D0000-0x00000000047F9000-memory.dmpFilesize
164KB
-
memory/2876-65-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB