Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 01:57
Behavioral task
behavioral1
Sample
6e09ca0e67a45adf753d48e15fbaa340.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6e09ca0e67a45adf753d48e15fbaa340.exe
Resource
win10v2004-20240426-en
General
-
Target
6e09ca0e67a45adf753d48e15fbaa340.exe
-
Size
1.4MB
-
MD5
6e09ca0e67a45adf753d48e15fbaa340
-
SHA1
669ebb41f82aad0dd4638eab9a06b03891cb6a9f
-
SHA256
d50b569da8e0e6997a0ba87dda4afb2d225bef9ebe51d6dcbe2d6082aedfa82e
-
SHA512
8213b58d3e2f392a3d0529c909b6498ef70d8093f22bc9249afa51a5653c0508b3b1b6b85dd4e6a7239cd7d3cef8df21254a6e68683c5013ee8180a08a559738
-
SSDEEP
24576:V/Bh8LN7j6Isx//rYawaV+0JJfmmFB6Tv9KnV9T2EnU+OIR4svLMq:P+pKRx/gy4vj9KnaEnzOy4svLX
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1632-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x000700000001471d-5.dat upx behavioral1/memory/2448-64-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2268-89-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1632-106-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2448-109-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2268-110-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 6e09ca0e67a45adf753d48e15fbaa340.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\Z: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\M: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\H: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\K: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\O: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\T: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\U: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\V: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\X: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\A: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\Q: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\R: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\S: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\W: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\G: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\E: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\I: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\J: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\L: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\N: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\P: 6e09ca0e67a45adf753d48e15fbaa340.exe File opened (read-only) \??\B: 6e09ca0e67a45adf753d48e15fbaa340.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\FxsTmp\russian action trambling licking 50+ .mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\SysWOW64\IME\shared\tyrkish porn gay masturbation cock hairy (Melissa).mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\SysWOW64\FxsTmp\tyrkish horse hardcore [bangbus] cock .mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\SysWOW64\IME\shared\brasilian beastiality fucking several models feet girly (Tatjana).rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\SysWOW64\config\systemprofile\lesbian hidden shower .zip.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\american porn hardcore public feet .rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\System32\DriverStore\Temp\brasilian fetish beast uncut 40+ .avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\swedish kicking sperm [bangbus] 40+ .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\SysWOW64\config\systemprofile\horse [bangbus] latex .rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\hardcore hidden shoes .avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\bukkake [bangbus] cock penetration .mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Program Files\Windows Journal\Templates\italian animal fucking masturbation glans .rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Program Files (x86)\Google\Update\Download\trambling [milf] titts granny .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Program Files (x86)\Microsoft Office\Templates\beast [milf] feet .mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\lesbian girls titts bondage (Sarah).mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\beast public glans .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Program Files (x86)\Common Files\microsoft shared\russian cumshot lingerie masturbation shower .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\indian beastiality trambling [bangbus] penetration (Sonja,Samantha).rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\italian animal horse uncut black hairunshaved .zip.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\italian fetish bukkake several models YEâPSè& (Anniston,Liz).rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\horse xxx voyeur gorgeoushorny .mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Program Files\Common Files\Microsoft Shared\indian handjob lingerie public gorgeoushorny .mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Program Files\DVD Maker\Shared\brasilian nude fucking [milf] upskirt .avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Program Files (x86)\Google\Temp\american fetish trambling voyeur titts hairy (Sylvia).rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\danish kicking lingerie girls hairy .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\swedish handjob lingerie [bangbus] cock .mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\chinese hardcore full movie hotel .mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\indian horse fucking [free] YEâPSè& .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\american cumshot horse catfight feet (Gina,Sylvia).avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian cum hardcore voyeur blondie .rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\black kicking trambling full movie .avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\canadian lesbian [milf] sweet .avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\indian gang bang xxx [free] glans traffic .rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\sperm voyeur blondie .avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\brasilian action blowjob several models titts .zip.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\lingerie hot (!) titts .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\kicking sperm sleeping .avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\british gay catfight titts black hairunshaved .zip.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\spanish lesbian hidden traffic .avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\russian kicking bukkake [bangbus] granny .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\sperm public titts black hairunshaved .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\american kicking horse several models .mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\british lingerie uncut .avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\american animal lingerie several models leather .rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\danish handjob lesbian licking hole sweet (Liz).mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\lingerie public hole .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\british sperm big feet shower (Samantha).rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\fetish sperm big sweet .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\russian porn lesbian masturbation hole upskirt (Curtney).zip.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\chinese hardcore big .rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\cum trambling [bangbus] .rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\canadian bukkake catfight cock .zip.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\gang bang horse voyeur feet traffic .avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\blowjob licking feet girly (Melissa).avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\xxx [free] mistress (Sandy,Jade).mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\italian handjob blowjob licking (Sarah).mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\indian kicking trambling hidden titts black hairunshaved .zip.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\assembly\temp\black cum beast hot (!) young .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\german beast voyeur feet .mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\beast licking (Liz).zip.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\horse public (Sylvia).mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\norwegian blowjob big sm (Sonja,Sylvia).zip.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\Temp\beast public .zip.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\tyrkish fetish fucking masturbation balls .mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\bukkake [milf] .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\gay full movie ìï .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\black gang bang lesbian girls gorgeoushorny .avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\italian action trambling several models lady .avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\russian handjob fucking [bangbus] young (Sandy,Sylvia).avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\fetish xxx licking (Janette).avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\british gay hot (!) .mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\cum horse public boots .rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\xxx several models (Samantha).zip.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\british gay lesbian glans .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\porn fucking sleeping (Jade).avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\german trambling public cock stockings .mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\animal horse voyeur redhair .mpeg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\spanish gay several models redhair .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\american action fucking [free] (Melissa).mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\spanish fucking uncut hole 50+ (Jade).rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\porn fucking several models .avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\animal xxx uncut feet blondie (Liz).rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\beast [bangbus] granny .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\french lingerie licking .zip.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\SoftwareDistribution\Download\blowjob lesbian (Liz).rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\tyrkish handjob blowjob sleeping 50+ .rar.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\indian kicking bukkake girls upskirt .mpg.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\japanese handjob trambling [bangbus] cock ejaculation (Jade).avi.exe 6e09ca0e67a45adf753d48e15fbaa340.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\malaysia lesbian licking titts .zip.exe 6e09ca0e67a45adf753d48e15fbaa340.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 2268 6e09ca0e67a45adf753d48e15fbaa340.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1632 wrote to memory of 2448 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 28 PID 1632 wrote to memory of 2448 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 28 PID 1632 wrote to memory of 2448 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 28 PID 1632 wrote to memory of 2448 1632 6e09ca0e67a45adf753d48e15fbaa340.exe 28 PID 2448 wrote to memory of 2268 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 29 PID 2448 wrote to memory of 2268 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 29 PID 2448 wrote to memory of 2268 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 29 PID 2448 wrote to memory of 2268 2448 6e09ca0e67a45adf753d48e15fbaa340.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e09ca0e67a45adf753d48e15fbaa340.exe"C:\Users\Admin\AppData\Local\Temp\6e09ca0e67a45adf753d48e15fbaa340.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\6e09ca0e67a45adf753d48e15fbaa340.exe"C:\Users\Admin\AppData\Local\Temp\6e09ca0e67a45adf753d48e15fbaa340.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\6e09ca0e67a45adf753d48e15fbaa340.exe"C:\Users\Admin\AppData\Local\Temp\6e09ca0e67a45adf753d48e15fbaa340.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2268
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD53099f9c891b270974dbcfad3070070e7
SHA1f77b93528135d795253c15865165043cc77eac4e
SHA2567e8881001e2cab98908880a7e9b4b00d383e2025b9cd90f89df7053fbbd198c7
SHA512b3c76569ed5c5aa76819007f1fe6f45e3604288b1e1cfe7d16b5559c743d1ba524422f48ac4d068719afdf36b5814428cbfa91f91eacfd3ab8430888ba8c2f33
-
Filesize
183B
MD5c1df5366eaf5dd2357495cab00913a70
SHA1e2158f001fb426871e586bc68b0d62ac865aaeab
SHA25687667b55c9ae8f5304006779e768fb7d60992031c66e9f78ff8157a55e741db1
SHA5127ae543a3c0bf5ec08d6f6e7c0915e17390d73e85a8f30e294c73fb1458e0387f66a5e22b1ef38a74871aa1279e3a05da63138b0a615494144c1554e941b202d6