Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:12
Behavioral task
behavioral1
Sample
35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe
Resource
win10v2004-20240709-en
General
-
Target
35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe
-
Size
1.9MB
-
MD5
d6a60ecc980c5e0520206e6b7d0bd8dc
-
SHA1
7f9f4ed23e86fc31e072e2f139c0f19d9204a6e1
-
SHA256
35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935
-
SHA512
5f4511dd61f92edbb7a70c9e2123ed51d7b2f3f98b401f4bb8514b2fd9eca5bc49616de2a86ce720b372db1c59b01e1662ede0c92bdeb9b89be3fc231b30ff49
-
SSDEEP
49152:dqEL+MHdfnPqPFVGBkeLsrTfZKzr+I7u5ndYPXZB3omFEXL0:dqEZsPsleKzqIXEmq0
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/3044-0-0x0000000000400000-0x0000000000456000-memory.dmp upx C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\bukkake lesbian titts balls .avi.exe upx behavioral1/memory/332-56-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/332-90-0x0000000004D40000-0x0000000004D96000-memory.dmp upx behavioral1/memory/2660-91-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/3044-107-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/332-110-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/332-112-0x0000000004D40000-0x0000000004D96000-memory.dmp upx behavioral1/memory/2660-113-0x0000000000400000-0x0000000000456000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exedescription ioc process File opened (read-only) \??\A: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\L: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\R: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\U: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\P: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\S: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\V: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\X: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\B: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\J: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\K: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\O: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\Y: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\Z: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\N: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\Q: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\T: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\G: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\H: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\I: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\M: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\E: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File opened (read-only) \??\W: 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe -
Drops file in System32 directory 10 IoCs
Processes:
35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\lingerie licking boots .mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\System32\DriverStore\Temp\hardcore sleeping glans (Sonja,Melissa).mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\SysWOW64\IME\shared\american beastiality fucking full movie hairy .mpeg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\SysWOW64\FxsTmp\danish kicking sperm voyeur .mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\gay big young .rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\SysWOW64\FxsTmp\canadian trambling voyeur (Sylvia).avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\indian animal bukkake public hole traffic .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\SysWOW64\config\systemprofile\indian nude beast masturbation glans upskirt (Curtney).rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\italian beastiality xxx voyeur titts circumcision .avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\SysWOW64\IME\shared\tyrkish cum trambling uncut .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe -
Drops file in Program Files directory 15 IoCs
Processes:
35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exedescription ioc process File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\horse girls .avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Program Files\Windows Journal\Templates\horse public .avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Program Files (x86)\Google\Update\Download\danish action hardcore voyeur glans stockings (Karin).mpeg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\gay sleeping feet .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\tyrkish nude xxx full movie titts beautyfull (Samantha).mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\beast sleeping swallow .mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\gay masturbation latex .avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Program Files\Common Files\Microsoft Shared\japanese gang bang horse full movie cock ìï .mpeg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Program Files\DVD Maker\Shared\norwegian gay lesbian hole (Jenna,Samantha).avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\swedish gang bang beast several models titts (Kathrin,Jade).avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\bukkake lesbian titts balls .avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Program Files (x86)\Common Files\microsoft shared\italian kicking fucking public boots .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\lesbian [bangbus] bondage .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Program Files (x86)\Google\Temp\danish kicking lingerie [bangbus] .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Program Files (x86)\Microsoft Office\Templates\horse sleeping latex .mpeg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe -
Drops file in Windows directory 64 IoCs
Processes:
35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exedescription ioc process File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\indian horse hardcore [milf] titts .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\canadian gay [milf] glans sm (Sylvia).rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\french blowjob [free] glans .rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\african xxx [bangbus] upskirt .avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\german fucking [free] bondage .mpeg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\african fucking licking .rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\bukkake hot (!) titts .mpeg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\asian lingerie hidden hole hairy (Jade).zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\french lingerie hidden titts ìï (Janette).mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\hardcore lesbian cock penetration (Tatjana).zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\sperm catfight hole pregnant (Jade).rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\american horse trambling sleeping fishy .rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\hardcore [milf] young .avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\swedish cum fucking voyeur feet wifey (Karin).rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian cumshot trambling catfight feet .rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\animal xxx masturbation (Tatjana).mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\spanish lesbian licking cock .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\beastiality hardcore big feet (Ashley,Curtney).mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\horse beast big young .mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\russian beastiality lingerie sleeping high heels .mpeg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\malaysia lesbian lesbian (Jade).avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\beastiality horse [milf] upskirt .mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\lesbian hot (!) upskirt .mpeg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\indian porn sperm hot (!) balls .avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\danish handjob beast sleeping glans fishy .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\porn horse voyeur gorgeoushorny .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\american cumshot hardcore lesbian titts mature .mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\american kicking sperm uncut cock (Ashley,Tatjana).mpeg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\cumshot bukkake catfight titts stockings .mpeg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\cumshot xxx catfight glans latex .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\russian handjob beast hidden glans .mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\black nude horse several models hole black hairunshaved (Sylvia).mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\african gay lesbian glans ejaculation .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\italian animal blowjob hidden feet redhair .avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\malaysia sperm public feet shower (Jade).mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\american cumshot trambling full movie cock granny .rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\indian action sperm full movie sweet .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\xxx uncut redhair (Sandy,Tatjana).rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\xxx voyeur feet blondie (Samantha).zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\cum lesbian full movie bondage .avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\swedish cumshot trambling [bangbus] glans swallow .mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\beast full movie .mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\swedish cum xxx hot (!) cock .rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\french lingerie girls glans shower (Melissa).zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\italian beastiality gay full movie (Curtney).zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\malaysia beast big boots .avi.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\beast sleeping cock shoes (Sarah).mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\fetish sperm lesbian swallow .rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\russian porn trambling [milf] redhair .rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\gay [milf] cock (Sandy,Sarah).zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\bukkake public girly .mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\russian nude bukkake [bangbus] hole .mpeg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\russian porn xxx masturbation hole mistress (Jade).rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\swedish action horse uncut shoes .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\gay [milf] feet stockings .rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\assembly\temp\gay hidden castration .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\american nude trambling several models 50+ .zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\gay licking titts upskirt (Sarah).zip.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\italian fetish lesbian public latex (Sandy,Sylvia).rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\tyrkish porn gay uncut wifey .mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\danish kicking bukkake [milf] lady .rar.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\PLA\Templates\italian beastiality bukkake full movie .mpeg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\handjob lesbian [milf] (Liz).mpg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\african beast lesbian femdom .mpeg.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exepid process 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 2660 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exedescription pid process target process PID 3044 wrote to memory of 332 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe PID 3044 wrote to memory of 332 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe PID 3044 wrote to memory of 332 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe PID 3044 wrote to memory of 332 3044 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe PID 332 wrote to memory of 2660 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe PID 332 wrote to memory of 2660 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe PID 332 wrote to memory of 2660 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe PID 332 wrote to memory of 2660 332 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe 35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe"C:\Users\Admin\AppData\Local\Temp\35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe"C:\Users\Admin\AppData\Local\Temp\35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Local\Temp\35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe"C:\Users\Admin\AppData\Local\Temp\35eaff0a382a88dc16c4bb686a102ad3a406b58db414a807d2f95d4c2d653935.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
834KB
MD58dc21d3a8d5ac5e33795b531d33da385
SHA1b7f78464fee6c04a6c9a231b845c68ca7ccc262c
SHA2568665a81a439927235bb48f7c89e7f1a6cfb17b0a69078756ca307bb14b78a368
SHA5120a46d2994488cfaf61160bfca4d3fb13ea1dabbf7d3106b84b4a9c04ae1076f88bfb335c1780b74e9086c4317bdf05b4567cd6068dbf62e9f7f76ddae139329a
-
Filesize
183B
MD5ec803863a8ec2fee7e0a0b157b755b69
SHA1a15f03ed4b26b3172a770ec009961f7751d884eb
SHA2569bda5e75010ce0d009eded0134a758ce6c77e83d3426ef44faa1759664ae8843
SHA512ccda5d0fb28c99928cf98877adc138edb7b435fdee86deb3cdb7fabc6abdaee68d84587ae68199ea3dafa840ff722ecb79a3e2a9f2b37fac46b7c7de5de56e21