Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 22:24
Static task
static1
Behavioral task
behavioral1
Sample
6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe
Resource
win10v2004-20240704-en
General
-
Target
6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe
-
Size
1.3MB
-
MD5
a4ec5deedad6e98443dc1c5428422303
-
SHA1
47e74904cdde579990ff2abbffbca1e02fb9b689
-
SHA256
6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a
-
SHA512
6e4b09b7bb39dba133ba0dac568fb5ffe2574e0fb7963a955037b4d39583994424e73ffec9b1cb65a604ba82f4132fd52d74f8839d5a629d937d828348897b1c
-
SSDEEP
24576:oWATI6CqOjcrPzbQjxs8iTssdQqie0XldyMHroctUj2TOoQgzn3aSv:VATTfrrEDsTdQm0pxmiqgGE
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\R: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\T: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\V: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\W: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\I: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\S: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\U: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\H: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\G: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\J: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\M: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\N: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\P: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\X: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\Y: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\A: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\Z: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\E: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\K: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\L: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\Q: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File opened (read-only) \??\B: 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\System32\LogFiles\Fax\Incoming\indian nude hardcore [bangbus] (Tatjana).mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\SysWOW64\config\systemprofile\hardcore several models black hairunshaved (Jenna,Melissa).avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian handjob lingerie uncut hole swallow (Curtney).mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\fucking big sm .mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\SysWOW64\IME\shared\sperm sleeping .avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\SysWOW64\FxsTmp\french lesbian [bangbus] hole young (Jade).mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\SysWOW64\FxsTmp\indian handjob trambling full movie titts .mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\SysWOW64\IME\shared\fucking masturbation beautyfull .mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\SysWOW64\config\systemprofile\american kicking sperm public redhair .avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\System32\DriverStore\Temp\tyrkish nude lingerie [milf] .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\brasilian action lingerie public feet .mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\horse full movie bondage .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\japanese beastiality gay hidden mature .avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\danish kicking trambling masturbation gorgeoushorny .zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Program Files (x86)\Microsoft Office\Templates\italian fetish horse catfight hole ejaculation .mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Program Files (x86)\Google\Update\Download\trambling catfight .mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\gay catfight titts .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Program Files\Windows Journal\Templates\brasilian gang bang beast hidden bondage (Britney,Karin).mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\italian kicking hardcore [free] cock .zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Program Files (x86)\Common Files\microsoft shared\danish animal trambling [free] .avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Program Files (x86)\Google\Temp\russian porn bukkake public cock high heels .mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\japanese cumshot bukkake [bangbus] cock boots (Janette).mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Program Files\DVD Maker\Shared\danish action fucking [free] .mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\danish handjob lingerie lesbian .mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\black kicking horse big titts (Sonja,Sarah).rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\italian fetish bukkake girls mature .mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\xxx public (Liz).mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\action bukkake hidden blondie (Kathrin,Curtney).zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\cum sperm catfight (Melissa).mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\spanish xxx catfight YEâPSè& .mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\bukkake catfight bondage .avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\african lesbian lesbian hole traffic .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\fucking hidden .mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\gay lesbian .zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\handjob lingerie [free] bedroom (Sonja,Sylvia).mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\swedish cumshot lingerie sleeping 40+ (Christine,Tatjana).zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\spanish blowjob lesbian (Tatjana).mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\Temp\lingerie [bangbus] femdom .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\fucking public stockings .mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\japanese action beast several models .avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\swedish fetish lingerie hot (!) .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\cum lesbian hidden upskirt .avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\danish kicking xxx sleeping .mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\danish animal beast masturbation leather .zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\indian cum xxx voyeur .zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\american handjob fucking hot (!) granny .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\animal lingerie voyeur titts (Anniston,Melissa).mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\handjob horse sleeping (Sylvia).avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\blowjob uncut stockings .mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian gang bang lesbian hot (!) swallow .zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\japanese porn gay [milf] cock bedroom .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\italian action hardcore voyeur glans .zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\danish fetish bukkake full movie upskirt .avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\SoftwareDistribution\Download\horse hot (!) hole .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\danish action trambling sleeping cock .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\british gay lesbian wifey .zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\blowjob [free] shoes .mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\indian action bukkake hidden .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\bukkake several models (Jade).rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\russian nude gay sleeping mature (Britney,Karin).mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\animal sperm masturbation (Liz).rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\african horse girls (Tatjana).rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\british lesbian voyeur bondage .mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\fucking licking hole .mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\danish horse sperm several models shoes .mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\african hardcore [milf] blondie (Sonja,Samantha).zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\trambling hot (!) hole 50+ .mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\chinese sperm hidden bedroom .avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\security\templates\american gang bang lingerie big hole .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\danish nude sperm public granny .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\kicking gay hidden YEâPSè& (Britney,Melissa).rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\gang bang xxx girls .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\chinese hardcore [milf] titts wifey (Tatjana).avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\hardcore [bangbus] 50+ .avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\beastiality lesbian [milf] young .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\norwegian bukkake full movie glans .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\german trambling girls shower .mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\black cum gay full movie .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\animal gay girls shower .avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\mssrv.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\fetish horse public gorgeoushorny .mpg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\italian gang bang lesbian hidden sweet .rar.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\fetish trambling girls castration .zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\german sperm uncut glans penetration (Sylvia).avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\handjob gay several models swallow .zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\american kicking beast [milf] fishy .avi.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\asian horse public glans .zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\xxx big .mpeg.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\trambling uncut cock young .zip.exe 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 1436 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2708 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 30 PID 2472 wrote to memory of 2708 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 30 PID 2472 wrote to memory of 2708 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 30 PID 2472 wrote to memory of 2708 2472 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 30 PID 2708 wrote to memory of 1436 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 31 PID 2708 wrote to memory of 1436 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 31 PID 2708 wrote to memory of 1436 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 31 PID 2708 wrote to memory of 1436 2708 6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe"C:\Users\Admin\AppData\Local\Temp\6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe"C:\Users\Admin\AppData\Local\Temp\6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe"C:\Users\Admin\AppData\Local\Temp\6125ff31a0b938c5a392f9673055e6444337dbb259d06255a1717d948213358a.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1436
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD550b2c6a157f711911502ed83876d1c5c
SHA1071605ce9d41bd606f08e2c7891bdd7f315356f5
SHA256b0616247033700140a4b3c560cb1f45055fcbd0e55b50808b759a522e6f1804e
SHA51223c7f538202beaf5d25390732370e857660e8c744bc83d52b5b69f533567de9885197dceceb57d7acb5030f378890c7810971320078617b40f23003617baadb2