Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 05:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
49eabe0b72c309ee07a6198f775e91a0.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
49eabe0b72c309ee07a6198f775e91a0.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
49eabe0b72c309ee07a6198f775e91a0.exe
-
Size
352KB
-
MD5
49eabe0b72c309ee07a6198f775e91a0
-
SHA1
1af17504125a1d2352bf7c8741c8c00690fd5e0a
-
SHA256
440bdf8d2e91860287db883a05ba24d14782bce520de18900f8540335f0d85c8
-
SHA512
92b0359975647447d9b446aa50938ab0773d219689dd1477931fea7a28abdcc0fe8f98839de07b37fbcabeb47ac89115129b420c5ef0eb86834ff3b6931d7430
-
SSDEEP
6144:dXC4vgmhbIxs3NBBL2VYiOHfGiilpEkV+QVznZqh67Ew5fwliGS77uIhqxpK7+79:dXCNi9B98YiO/GwkTVjZ97EwlyS77uI4
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 49eabe0b72c309ee07a6198f775e91a0.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\N: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\Q: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\X: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\Y: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\Z: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\E: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\I: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\J: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\M: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\O: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\P: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\R: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\S: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\B: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\G: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\L: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\U: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\V: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\W: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\H: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\K: 49eabe0b72c309ee07a6198f775e91a0.exe File opened (read-only) \??\T: 49eabe0b72c309ee07a6198f775e91a0.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\american porn hardcore uncut black hairunshaved .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\SysWOW64\FxsTmp\german porn masturbation high heels (Curtney,Tatjana).avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\SysWOW64\config\systemprofile\spanish horse [milf] vagina .avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\blowjob big hole (Anniston,Jenna).zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\SysWOW64\FxsTmp\malaysia trambling horse big cock granny .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\chinese beast hardcore lesbian hairy .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\System32\DriverStore\Temp\brasilian trambling beastiality public boobs .mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\SysWOW64\IME\shared\chinese sperm hidden leather .avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\porn kicking hot (!) feet granny (Christine).zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\SysWOW64\IME\shared\swedish handjob girls legs shoes (Melissa).mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\microsoft shared\norwegian sperm licking .mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Program Files (x86)\Google\Temp\cumshot horse hot (!) hairy .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Program Files (x86)\Google\Update\Download\sperm voyeur redhair (Tatjana,Jenna).mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\brasilian lingerie several models hole penetration .mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Program Files\Common Files\Microsoft Shared\animal fucking catfight beautyfull .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\malaysia bukkake blowjob full movie feet young .mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Program Files\DVD Maker\Shared\handjob beastiality several models .rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Program Files\Windows Journal\Templates\italian kicking licking .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\american sperm [free] 50+ .mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\fucking big .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\brasilian fetish action lesbian 50+ .mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Program Files (x86)\Microsoft Office\Templates\action action big swallow .avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\swedish lesbian lesbian full movie .rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\malaysia gang bang girls titts high heels .rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\german fetish lesbian feet .avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\japanese animal lesbian lesbian vagina sm .rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\assembly\temp\british fucking catfight stockings .avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\african horse beastiality hidden glans (Kathrin).avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\tyrkish lingerie masturbation young .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\german horse sleeping (Jenna,Jade).zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\animal sleeping glans high heels .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\Temp\cumshot catfight ejaculation .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\blowjob blowjob catfight hole .avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\spanish nude fucking uncut .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\lingerie lesbian .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\chinese sperm hidden legs (Sonja).avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\fetish girls titts .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\french cum public ash (Tatjana).mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\sperm nude girls glans hotel .mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\mssrv.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\swedish hardcore bukkake girls black hairunshaved .avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\sperm porn [milf] mistress .rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\japanese xxx masturbation shower .rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\fucking lesbian ìï (Britney,Sylvia).rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\american nude cum public fishy .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\tyrkish horse blowjob big YEâPSè& .mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\american blowjob handjob several models shower .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\animal sleeping .avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\fetish [milf] boobs YEâPSè& (Anniston,Anniston).mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\canadian cumshot porn masturbation .mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\handjob animal licking ìï (Sylvia,Kathrin).zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\blowjob public mistress .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\asian gay [bangbus] .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\action beast hot (!) titts (Sarah).rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\security\templates\gay several models cock blondie .mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\lingerie public granny .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\german trambling public (Christine).mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\sperm beast licking nipples mature .mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\indian fucking beast voyeur redhair .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\canadian cum porn full movie shoes .rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\chinese gang bang public beautyfull .mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\canadian animal cum full movie .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\swedish animal lesbian [bangbus] pregnant .rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\nude porn lesbian nipples .mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\lesbian gang bang full movie mistress .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\spanish bukkake sperm [bangbus] .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\russian nude trambling full movie mature .avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\InstallTemp\asian beastiality cumshot sleeping .rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\british handjob masturbation circumcision .mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\german cumshot hidden .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\lesbian nude voyeur vagina redhair .avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\indian horse action uncut lady .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\brasilian sperm hot (!) .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\japanese fetish girls (Jade).mpeg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\SoftwareDistribution\Download\italian cumshot action girls .rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\bukkake gang bang licking gorgeoushorny .rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\asian gang bang big mature .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\russian fucking girls boobs sm .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\action horse voyeur titts sweet .mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\tyrkish kicking sperm lesbian femdom (Sylvia,Samantha).zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\spanish lesbian cumshot sleeping .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\horse gay [milf] bondage .rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\italian kicking fucking [bangbus] wifey .avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\italian horse trambling catfight lady .rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\fetish cumshot lesbian girly .rar.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\handjob handjob masturbation blondie .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\handjob sleeping black hairunshaved .avi.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\swedish beastiality porn hot (!) castration .zip.exe 49eabe0b72c309ee07a6198f775e91a0.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\cumshot blowjob catfight shoes (Samantha).mpg.exe 49eabe0b72c309ee07a6198f775e91a0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe 2132 49eabe0b72c309ee07a6198f775e91a0.exe 2616 49eabe0b72c309ee07a6198f775e91a0.exe 1280 49eabe0b72c309ee07a6198f775e91a0.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2616 2132 49eabe0b72c309ee07a6198f775e91a0.exe 28 PID 2132 wrote to memory of 2616 2132 49eabe0b72c309ee07a6198f775e91a0.exe 28 PID 2132 wrote to memory of 2616 2132 49eabe0b72c309ee07a6198f775e91a0.exe 28 PID 2132 wrote to memory of 2616 2132 49eabe0b72c309ee07a6198f775e91a0.exe 28 PID 2616 wrote to memory of 1280 2616 49eabe0b72c309ee07a6198f775e91a0.exe 29 PID 2616 wrote to memory of 1280 2616 49eabe0b72c309ee07a6198f775e91a0.exe 29 PID 2616 wrote to memory of 1280 2616 49eabe0b72c309ee07a6198f775e91a0.exe 29 PID 2616 wrote to memory of 1280 2616 49eabe0b72c309ee07a6198f775e91a0.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\49eabe0b72c309ee07a6198f775e91a0.exe"C:\Users\Admin\AppData\Local\Temp\49eabe0b72c309ee07a6198f775e91a0.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\49eabe0b72c309ee07a6198f775e91a0.exe"C:\Users\Admin\AppData\Local\Temp\49eabe0b72c309ee07a6198f775e91a0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\49eabe0b72c309ee07a6198f775e91a0.exe"C:\Users\Admin\AppData\Local\Temp\49eabe0b72c309ee07a6198f775e91a0.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1280
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
275KB
MD5b5aa083a6390991650e73d53e13611d6
SHA1b46307fa59e16fee9a5d7e0134cbca38415b25f1
SHA25684d2abcf73ef2638f34c4d0be0052ea038afa0e8ac2c7fddb54d9115572d30f8
SHA5128b94d3046e4c7b980238b249c68cf1aae298112302b8cfa088ced646d0f6701c65e5b302cce5a3400734848bd515b0d518d6ac62fb73d9dd4c57e8d472c11df5
-
Filesize
183B
MD56e741ee8c12607b63abf896ca9139a89
SHA171b7100b6fba59d0c8c1cb0c0bd08c105f6bbb9d
SHA2564eda60097e9296293acd13b82ddc6a438548be7e50ddcd0f6e092b739b223ec9
SHA51297db2d2bd4606d5a60b3168b47ac8b27aa9770d6d678e740fd9104e81b12f7f513aeed51a1211505086b54ad41be719b0b54e3fc2390fe33c31c403ec124712b