Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 04:22
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe
-
Size
1.8MB
-
MD5
562a2ac34fdd02dcc1d1c7601be69570
-
SHA1
4676d1535df9e11de58c98e7e437d11d71e14e06
-
SHA256
e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294
-
SHA512
08e85f40a2b00529a3317422590a0b25c7e1e16a60bcb854263267b83ae88faa19cb298e69abb995d70dc26728de3d5652de8a116d2ead6a2da5ec8c4e335856
-
SSDEEP
49152:Cjeq+8FaqV8KWPbuu6VQNPPjifIztnWhaMtLpD:Gt+8oqV8KWPih6NPPjiQztWZN
Score
9/10
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
resource yara_rule behavioral1/files/0x0009000000013a76-4.dat INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\P: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\T: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\U: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\H: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\L: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\O: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\R: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\V: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\Z: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\E: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\M: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\N: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\X: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\A: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\B: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\G: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\I: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\K: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\Q: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\S: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\W: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File opened (read-only) \??\Y: e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\asian bukkake licking vagina boots (Jade,Jenna).rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian gang bang fetish voyeur .zip.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\SysWOW64\FxsTmp\trambling horse [bangbus] .zip.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian hardcore sleeping granny .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\SysWOW64\FxsTmp\kicking [milf] boobs penetration (Liz,Kathrin).zip.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\SysWOW64\IME\shared\russian beast big young (Curtney,Jade).avi.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\System32\DriverStore\Temp\horse cumshot [bangbus] nipples beautyfull .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\SysWOW64\IME\shared\beastiality sleeping ash boots .rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\german handjob hidden .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\SysWOW64\config\systemprofile\norwegian cum handjob sleeping legs YEâPSè& (Ashley,Gina).rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\spanish animal uncut cock femdom (Samantha,Kathrin).avi.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\swedish lesbian [free] sweet (Jade,Sandy).mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Program Files (x86)\Common Files\microsoft shared\german fucking cum public mature (Janette,Kathrin).mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\british action uncut circumcision .avi.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Program Files (x86)\Microsoft Office\Templates\indian animal kicking [free] shoes (Sonja).zip.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Program Files\Common Files\Microsoft Shared\danish handjob masturbation high heels .zip.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\trambling hot (!) pregnant .rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\canadian beast [free] 40+ .zip.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\italian horse action lesbian ash .rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Program Files (x86)\Google\Update\Download\brasilian porn full movie .rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Program Files (x86)\Google\Temp\horse gang bang catfight (Sonja,Samantha).zip.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\brasilian cumshot cum masturbation hairy (Gina,Sonja).mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\malaysia action fucking sleeping ash .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\japanese trambling action big 50+ .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Program Files\Windows Journal\Templates\xxx cum girls swallow .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\Downloads\blowjob catfight .rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\hardcore beast hot (!) (Christine,Samantha).avi.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\malaysia trambling sleeping hole shoes .avi.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\hardcore beast uncut legs leather .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\black animal porn hot (!) stockings .avi.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\lingerie several models beautyfull .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\PLA\Templates\action hot (!) .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\british kicking lesbian boobs .rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\gay fucking lesbian feet .avi.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\tyrkish beast uncut castration .avi.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\Downloaded Program Files\asian beastiality big YEâPSè& (Melissa,Melissa).mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\russian gang bang fetish big hole pregnant .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\fucking uncut femdom .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\french kicking animal voyeur ìï .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\tyrkish animal lesbian (Gina,Britney).rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\lesbian sperm several models ejaculation .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\sperm hardcore licking cock latex .rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\swedish trambling big .zip.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\SoftwareDistribution\Download\trambling action several models .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\malaysia fucking lesbian public hotel (Christine).rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\asian fucking lesbian big fishy (Sandy,Gina).mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\assembly\temp\asian blowjob several models sm .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\danish action public .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\japanese bukkake licking ìï .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\InstallTemp\swedish hardcore fetish lesbian legs black hairunshaved .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\danish gay masturbation titts pregnant (Gina,Sarah).rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\handjob lesbian .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\french fetish action several models swallow .zip.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\danish porn catfight vagina swallow (Sonja,Janette).avi.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\italian cum hardcore hot (!) femdom (Karin).avi.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\brasilian blowjob [bangbus] vagina leather (Sandy).zip.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\lesbian sleeping blondie (Jade).mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\bukkake voyeur shoes (Sonja,Karin).mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\fetish beast licking fishy .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\american beast gay [milf] vagina 40+ (Kathrin).mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\tyrkish sperm masturbation .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\gang bang catfight wifey (Melissa).rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\norwegian animal cumshot hot (!) .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\beastiality big .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\british trambling fucking public .avi.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\brasilian beastiality hot (!) high heels .zip.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\sperm [free] (Tatjana,Karin).mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\tyrkish lingerie uncut girly .rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\french fucking hardcore voyeur .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\canadian handjob bukkake girls cock redhair (Sandy).rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\african xxx girls ash young .avi.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\american nude sleeping boobs ìï .zip.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\canadian beastiality action girls lady (Sandy,Janette).mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\japanese nude xxx hot (!) cock .zip.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\russian cumshot cum several models YEâPSè& .rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\nude several models shoes .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\danish lesbian masturbation .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\handjob sleeping circumcision .rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\black sperm fucking [bangbus] bedroom .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\blowjob blowjob big .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\german fetish blowjob sleeping .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\trambling gang bang catfight blondie .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\british xxx hardcore masturbation shower .avi.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\norwegian animal kicking voyeur .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\german xxx girls .rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\sperm bukkake sleeping lady (Melissa,Gina).rar.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\tyrkish lesbian uncut boobs .mpg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\african beast voyeur boobs .avi.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\malaysia lesbian full movie black hairunshaved .mpeg.exe e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2968 2060 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2960 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2004 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 28 PID 2060 wrote to memory of 2004 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 28 PID 2060 wrote to memory of 2004 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 28 PID 2060 wrote to memory of 2004 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 28 PID 2004 wrote to memory of 2960 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 29 PID 2004 wrote to memory of 2960 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 29 PID 2004 wrote to memory of 2960 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 29 PID 2004 wrote to memory of 2960 2004 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 29 PID 2060 wrote to memory of 2968 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 30 PID 2060 wrote to memory of 2968 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 30 PID 2060 wrote to memory of 2968 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 30 PID 2060 wrote to memory of 2968 2060 e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe"C:\Users\Admin\AppData\Local\Temp\e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe"C:\Users\Admin\AppData\Local\Temp\e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe"C:\Users\Admin\AppData\Local\Temp\e66043370dc8be82b442652f02724446978b6f94c85643bc7c88b58c2a9d0294.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2960
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 3642⤵
- Program crash
PID:2968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD56188b268d6f9decb50c61ca6c5965828
SHA1c8c7e5d45f61438b9a017e18959f6ad16365223d
SHA2567827c43e61c6a4883bda2fbbdfff925996bb6c173eb1ee6e537133da7fe8ab12
SHA51266a4f2407ed3fd9c33c54d5036196a7bdefbcecad5287c3ba0ab6b4376c4be6711a06a24b58c747da9bf73d124ac164bd0f71998d3896f542909ddb27700f2df
-
Filesize
183B
MD57766ebd5c6c05a45ea6c39cafd0654ee
SHA15eba6e1b83cea96bbf598b14ed3f54af7d912af1
SHA256b4fcce82122e43fea508d308c078af924fc0ab148623318a8459e4384773cf02
SHA512d1b9121ee1ce3595e77a3486ca5c52b3853918f42847e21135377d574727755559bcc1d6671ea07b698b46f0c7223f51b274ce51f39e1f811cb0a9d73c5244d4