Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 05:03
Static task
static1
Behavioral task
behavioral1
Sample
ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe
Resource
win10v2004-20240508-en
General
-
Target
ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe
-
Size
243KB
-
MD5
88f741a5cbe54409d9b9e60db78d80b2
-
SHA1
443c5168049a4d388fd7377c04d2a6cf87ea873f
-
SHA256
ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c
-
SHA512
652f522cda812506bae038fa8950c9fdfdde9be6765d847c338ee0a433eb09fb1b56d67d4aa3f978876889b9bef79e1064f2778c8c1c41dd38d2f8a3e1b71b84
-
SSDEEP
6144:dXC4vgmhbIxs3NBR3zskkSHyBiDQLyLSyV151qNv:dXCNi9BZAkljDQeLSkf1qF
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
resource yara_rule behavioral1/files/0x0007000000016c5b-4.dat INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\I: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\W: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\S: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\V: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\X: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\Y: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\E: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\G: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\J: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\M: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\N: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\P: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\Q: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\T: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\B: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\H: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\K: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\U: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\Z: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\L: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\O: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File opened (read-only) \??\R: ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\beast masturbation hotel .avi.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\SysWOW64\config\systemprofile\african gay cumshot [bangbus] vagina 40+ .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\french gang bang beastiality lesbian feet pregnant .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\SysWOW64\IME\shared\tyrkish sperm [free] 40+ .zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\lesbian animal public glans .zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\SysWOW64\IME\shared\blowjob girls (Sarah,Jade).avi.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\System32\DriverStore\Temp\german gang bang lesbian (Anniston).mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\SysWOW64\FxsTmp\american fetish cum lesbian hotel .zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\SysWOW64\config\systemprofile\asian bukkake big nipples femdom .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\SysWOW64\FxsTmp\animal kicking full movie girly .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\action catfight (Sonja,Liz).zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Program Files\DVD Maker\Shared\american fetish hot (!) (Gina).rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Program Files\Windows Journal\Templates\trambling horse uncut .zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Program Files (x86)\Microsoft Office\Templates\asian beast [milf] legs granny .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\swedish gay handjob full movie .zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\british fucking gang bang full movie (Liz).mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Program Files\Common Files\Microsoft Shared\french beastiality uncut .rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\swedish hardcore voyeur hairy .zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Program Files (x86)\Google\Temp\trambling lesbian (Melissa,Melissa).rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\beast hot (!) (Sonja,Sonja).zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\french trambling uncut nipples lady .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\fucking masturbation latex .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Program Files (x86)\Google\Update\Download\asian nude action girls balls .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\russian fucking hidden cock .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\beast kicking catfight (Janette).avi.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\cumshot beast masturbation wifey (Sonja).avi.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\asian porn fucking voyeur .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\trambling cum girls black hairunshaved .zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\canadian blowjob gay [bangbus] glans (Britney).zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\mssrv.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\french lesbian lingerie sleeping young .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\russian fucking kicking licking upskirt .avi.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\xxx horse sleeping (Sylvia).rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\spanish beastiality cum hot (!) penetration .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\nude masturbation latex (Britney).mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\bukkake public .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\assembly\tmp\gay hardcore [bangbus] vagina (Gina,Sonja).mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\japanese xxx trambling uncut (Sonja,Britney).zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\british gang bang porn [free] .rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\cumshot masturbation .rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\russian handjob hot (!) penetration .zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\horse lesbian .avi.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\InstallTemp\danish gay animal public .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\cumshot hot (!) boobs .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\japanese gang bang cum licking redhair .rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\beastiality hidden hole (Anniston).avi.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\porn cumshot catfight .avi.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\beast handjob girls .rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\italian lesbian lesbian .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\animal xxx masturbation (Sylvia).rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\chinese gang bang nude [milf] leather .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\handjob uncut 40+ .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\russian lingerie hot (!) hairy (Sandy).rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\brasilian porn horse full movie boobs gorgeoushorny .avi.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\indian lesbian licking .rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\british animal nude lesbian nipples ìï .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\sperm lesbian upskirt .rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\spanish gang bang voyeur stockings .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\beast public leather .zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\danish sperm hot (!) wifey (Curtney,Melissa).rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\norwegian cum fetish big (Sonja,Karin).avi.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\american horse voyeur ìï .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\british horse nude [milf] beautyfull .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\canadian beast hardcore [bangbus] .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\assembly\temp\trambling uncut boobs .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\tyrkish nude [bangbus] .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\spanish bukkake public (Britney).rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\animal uncut granny .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\gay uncut .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\tyrkish sperm gang bang several models swallow .zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\swedish sperm horse full movie .rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\sperm gay catfight blondie .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\german gang bang trambling full movie circumcision .rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\chinese sperm kicking full movie sweet .zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\cum gang bang girls balls (Kathrin).mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\cum [free] .rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish gang bang lesbian several models hole (Sonja).mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\swedish hardcore horse [milf] .avi.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\malaysia sperm gang bang masturbation high heels (Gina).rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\horse public .rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\beast fucking masturbation leather .mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\malaysia beastiality uncut legs wifey .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\british blowjob beastiality public glans .rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\russian beast porn full movie mature .mpeg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\tyrkish trambling gay sleeping nipples (Tatjana,Ashley).avi.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\lingerie big (Britney,Britney).zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\tyrkish fetish action public feet (Janette).mpg.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\norwegian sperm trambling [bangbus] ash hotel .zip.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\swedish lingerie several models legs balls .rar.exe ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 1528 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1760 wrote to memory of 2488 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 28 PID 1760 wrote to memory of 2488 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 28 PID 1760 wrote to memory of 2488 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 28 PID 1760 wrote to memory of 2488 1760 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 28 PID 2488 wrote to memory of 1528 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 29 PID 2488 wrote to memory of 1528 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 29 PID 2488 wrote to memory of 1528 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 29 PID 2488 wrote to memory of 1528 2488 ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe"C:\Users\Admin\AppData\Local\Temp\ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe"C:\Users\Admin\AppData\Local\Temp\ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe"C:\Users\Admin\AppData\Local\Temp\ec5dcd76a232dfcd9643366e804c09b1f4ae64aff71407152f42efd25d871d4c.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1528
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
398KB
MD5fafcd9a19d18be7015dfd254361ec9fc
SHA1ede589c741bfcc6fd2ac39496b923552ae9f5bf3
SHA2564e6afa933a784a2de84fed9c4b6ddfdaa99a6f3682cdb16c563073615b55cf55
SHA5127898befda816cce46b304822418b052ed86ca99fc4f856c3f1d87817a01c81c277ff05a453165501f7ff4d948bf2904340dd2cd3d25eabfbe6eb6ef80df4b81d