4e748603387fac40c0477da3bcd56f8f7c28950143c6055aa6315f51fdb3e317

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 01:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1e4fc6c25de9386ce79d587b052724c0.exe
Size

421KB
MD5

1e4fc6c25de9386ce79d587b052724c0
SHA1

740cb7b7d01d87179f54dc89463ef206bff647d8
SHA256

4e748603387fac40c0477da3bcd56f8f7c28950143c6055aa6315f51fdb3e317
SHA512

2116b4f539a9927d17581858f60051906b4867d81de492a942e874292d8391508343f7a06a5b2e37d9463188095770de30d15dfb8467ab383f0b597615aa9527
SSDEEP

12288:A8EQoSMy+Hi3zi5f1IRAjwsThxvskYwqSqo:A8n+D7ThWkYTSqo

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1336-0-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x0007000000015364-5.dat	upx
behavioral1/memory/2412-52-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2544-50-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-82-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2500-88-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2544-89-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2412-90-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-91-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-92-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-97-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-102-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-116-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-120-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-124-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-128-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-134-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-138-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-142-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-146-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-150-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1336-154-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	1e4fc6c25de9386ce79d587b052724c0.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\X:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\J:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\K:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\L:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\N:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\O:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\S:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\Y:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\R:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\E:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\H:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\M:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\Q:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\W:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\Z:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\U:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\A:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\B:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\G:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\I:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\P:	1e4fc6c25de9386ce79d587b052724c0.exe
File opened (read-only)	\??\T:	1e4fc6c25de9386ce79d587b052724c0.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\gay lingerie [bangbus] sweet (Gina).avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\SysWOW64\FxsTmp\nude uncut titts balls .mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\danish animal hot (!) sweet (Curtney,Sarah).avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\SysWOW64\config\systemprofile\canadian lingerie beast masturbation .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\SysWOW64\IME\shared\sperm voyeur hole hotel (Christine,Melissa).zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\SysWOW64\config\systemprofile\kicking girls .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\french trambling nude hot (!) high heels .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\SysWOW64\IME\shared\brasilian hardcore big castration .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\sperm cumshot big .rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\SysWOW64\FxsTmp\bukkake xxx [bangbus] 50+ (Sarah).mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\tyrkish fetish sleeping titts .rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\sperm hot (!) granny .avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\lesbian fetish big .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\malaysia sperm public hole .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Program Files\DVD Maker\Shared\swedish hardcore sleeping .rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Program Files (x86)\Google\Update\Download\african animal bukkake voyeur redhair .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Program Files\Windows Journal\Templates\italian hardcore hidden ash .rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\german nude gang bang girls .avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Program Files (x86)\Google\Temp\black hardcore [milf] .rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\german fetish gay lesbian (Curtney,Samantha).avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\german beastiality fucking [bangbus] glans (Kathrin,Sonja).mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\russian nude beastiality [milf] swallow .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\german sperm catfight .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\action uncut castration (Samantha,Kathrin).mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\lingerie hardcore girls granny (Tatjana).rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish fucking [bangbus] glans blondie (Samantha,Sylvia).zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\fucking big mature .avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\hardcore hot (!) girly .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\canadian trambling handjob full movie .avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\assembly\tmp\kicking horse masturbation latex .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\cum several models glans ejaculation (Samantha).rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\bukkake fetish several models .rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\malaysia cum blowjob public bedroom (Sandy).avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\british trambling lesbian (Ashley,Sonja).mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\indian hardcore beast voyeur feet young .mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\spanish lesbian horse lesbian glans 40+ .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\fetish cumshot girls stockings .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\InstallTemp\canadian trambling hot (!) (Tatjana).rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\xxx handjob big castration (Christine,Janette).mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\animal masturbation penetration (Tatjana,Samantha).mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\fucking xxx masturbation feet .mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\handjob catfight feet .rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\lesbian [milf] castration .mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\french action girls blondie .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\cumshot hot (!) ash .mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\african fetish full movie 40+ .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\african cum full movie upskirt .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\japanese hardcore xxx licking legs ejaculation .mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\lingerie fucking hot (!) shoes .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\blowjob lingerie lesbian .mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\xxx horse [bangbus] beautyfull .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\canadian porn masturbation glans redhair (Ashley).mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\norwegian horse [free] .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\canadian lesbian several models .avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\horse fetish hidden feet balls .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\trambling sleeping boobs traffic .rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\action horse catfight mistress .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\nude full movie lady .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\action beast masturbation ash .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\SoftwareDistribution\Download\german nude big feet femdom .mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\british handjob girls nipples .avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\handjob blowjob [bangbus] vagina fishy .mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\cumshot licking shower .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\canadian action several models (Curtney,Curtney).zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\asian beastiality cumshot girls .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\sperm lingerie full movie .mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\danish fetish cumshot lesbian boobs .avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\italian animal sperm [milf] hole shower .avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\animal gang bang sleeping .rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\horse horse [bangbus] lady (Kathrin,Christine).avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\horse hardcore voyeur girly .rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\PLA\Templates\black lesbian masturbation pregnant .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\chinese handjob several models cock ìï (Britney).mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\american nude hot (!) .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\chinese lesbian catfight castration .rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\fetish hardcore voyeur hole .rar.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\french action hardcore voyeur swallow .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\security\templates\indian beast catfight titts shower .mpeg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\japanese fetish hidden glans .mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\russian action [bangbus] feet girly (Jade).avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\horse [bangbus] mistress .avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\animal several models .mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\african animal masturbation femdom (Jade).avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\Temp\swedish beast kicking catfight (Samantha).zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\german action hot (!) .avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\chinese lingerie gay girls .avi.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\norwegian cum [milf] gorgeoushorny .mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\russian hardcore lesbian girls 50+ .zip.exe	1e4fc6c25de9386ce79d587b052724c0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\italian porn action licking titts .mpg.exe	1e4fc6c25de9386ce79d587b052724c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2544	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe
1336	1e4fc6c25de9386ce79d587b052724c0.exe
2500	1e4fc6c25de9386ce79d587b052724c0.exe
2412	1e4fc6c25de9386ce79d587b052724c0.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2500	1336	1e4fc6c25de9386ce79d587b052724c0.exe	28
PID 1336 wrote to memory of 2500	1336	1e4fc6c25de9386ce79d587b052724c0.exe	28
PID 1336 wrote to memory of 2500	1336	1e4fc6c25de9386ce79d587b052724c0.exe	28
PID 1336 wrote to memory of 2500	1336	1e4fc6c25de9386ce79d587b052724c0.exe	28
PID 1336 wrote to memory of 2544	1336	1e4fc6c25de9386ce79d587b052724c0.exe	29
PID 1336 wrote to memory of 2544	1336	1e4fc6c25de9386ce79d587b052724c0.exe	29
PID 1336 wrote to memory of 2544	1336	1e4fc6c25de9386ce79d587b052724c0.exe	29
PID 1336 wrote to memory of 2544	1336	1e4fc6c25de9386ce79d587b052724c0.exe	29
PID 2500 wrote to memory of 2412	2500	1e4fc6c25de9386ce79d587b052724c0.exe	30
PID 2500 wrote to memory of 2412	2500	1e4fc6c25de9386ce79d587b052724c0.exe	30
PID 2500 wrote to memory of 2412	2500	1e4fc6c25de9386ce79d587b052724c0.exe	30
PID 2500 wrote to memory of 2412	2500	1e4fc6c25de9386ce79d587b052724c0.exe	30

C:\Users\Admin\AppData\Local\Temp\1e4fc6c25de9386ce79d587b052724c0.exe
"C:\Users\Admin\AppData\Local\Temp\1e4fc6c25de9386ce79d587b052724c0.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Local\Temp\1e4fc6c25de9386ce79d587b052724c0.exe
  "C:\Users\Admin\AppData\Local\Temp\1e4fc6c25de9386ce79d587b052724c0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Users\Admin\AppData\Local\Temp\1e4fc6c25de9386ce79d587b052724c0.exe
    "C:\Users\Admin\AppData\Local\Temp\1e4fc6c25de9386ce79d587b052724c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2412
- C:\Users\Admin\AppData\Local\Temp\1e4fc6c25de9386ce79d587b052724c0.exe
  "C:\Users\Admin\AppData\Local\Temp\1e4fc6c25de9386ce79d587b052724c0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\sperm hot (!) granny .avi.exe

Filesize
517KB

MD5
102fb075706897e1397890f73c0a57ca

SHA1
8555d4a1aa75ecbddf9b95ccfa41adcdc8904f4c

SHA256
6d3b676c7cf49895fd9e1717045f01e7f93e81b7cdbee4281784daf659522780

SHA512
cd888a1d77c9a92676514d8b91f13705052ef5f274219ec7ef0d4d61fd975a914114611837cd78358297131162142470896bd246c8276054bd0537ad6da0d50b

Download Submit
C:\debug.txt

Filesize
183B

MD5
aa6fde296dfa880fca46243ac744e83a

SHA1
fa1ce8605faf1aa18ad6f8e0a826b3f2c9069c93

SHA256
da1e8c6ea9c4a58b9d7c40980903b0c71c024d66281c13cf838cb4b32ee8bac4

SHA512
aeae4828d75842d9a234c5b3768360b6dfcb9d610e1c6a5cc4b2d19ec4eadd9bdaab990b17d676c16daa11e456f8863cdb1519f0a22be87430303132f85d33ac

Download Submit
memory/1336-92-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-102-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-154-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-150-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-82-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-146-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-97-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-142-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-91-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-93-0x00000000049E0000-0x00000000049FC000-memory.dmp

Filesize
112KB

Download
memory/1336-138-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-134-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-124-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-17-0x00000000049E0000-0x00000000049FC000-memory.dmp

Filesize
112KB

Download
memory/1336-116-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-120-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1336-128-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2412-52-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2412-90-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2500-88-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2500-51-0x0000000004900000-0x000000000491C000-memory.dmp

Filesize
112KB

Download
memory/2544-89-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2544-50-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download