Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 17:15
Behavioral task
behavioral1
Sample
03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe
Resource
win10v2004-20240226-en
General
-
Target
03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe
-
Size
744KB
-
MD5
e6e4bf66fc96ac23cc55312ae429e3b8
-
SHA1
bb681963062721d2b60e5555199f047c42900191
-
SHA256
03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486
-
SHA512
6440014704c90f4e819649bdc90946b06c6bca294ab37c1c13a27307a4cd6c08d3b8355b4eb346fceac5459cd1d1b715497cab285644c04fc24deab757edb6b5
-
SSDEEP
12288:SEQoSC+dTiZkAw7kbimj4rES9WytrmTQvD3Y670N+ZasC1SlovPmYB7CtXz:S5+2kbis4oSUytUUD310NEw1kovPmYNc
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 5 IoCs
resource yara_rule behavioral2/memory/652-38-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4476-189-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3804-192-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3116-195-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/652-196-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral2/memory/4476-0-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/files/0x000700000002320d-5.dat UPX behavioral2/memory/3804-11-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/3116-36-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/652-38-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4476-189-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/3804-192-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/3116-195-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/652-196-0x0000000000400000-0x000000000041F000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4476-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000700000002320d-5.dat upx behavioral2/memory/3804-11-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3116-36-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/652-38-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4476-189-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3804-192-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3116-195-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/652-196-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\I: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\M: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\S: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\X: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\Y: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\A: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\O: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\P: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\T: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\V: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\W: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\Z: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\G: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\H: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\J: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\N: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\Q: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\R: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\U: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\B: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\K: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File opened (read-only) \??\L: 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\african hardcore hardcore catfight .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\SysWOW64\FxsTmp\indian fucking hidden hole (Christine,Samantha).rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\SysWOW64\IME\SHARED\russian beastiality masturbation .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\black beast voyeur bedroom (Anniston,Sandy).avi.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\SysWOW64\config\systemprofile\indian horse full movie cock .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\SysWOW64\FxsTmp\beastiality lesbian .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\SysWOW64\IME\SHARED\swedish animal masturbation penetration (Kathrin).zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\SysWOW64\config\systemprofile\brasilian horse licking lady .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\british gang bang bukkake hidden mistress .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\action cum hot (!) YEâPSè& (Sonja,Jade).rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\horse full movie (Sylvia).avi.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\chinese lesbian action hidden .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe -
Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Temp\trambling uncut ash blondie .mpg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files\Microsoft Office\root\Templates\russian gang bang girls cock (Jade,Ashley).rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\horse [free] .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\gay lingerie licking girly .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files\Common Files\microsoft shared\indian beastiality porn sleeping .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files\dotnet\shared\lingerie lesbian girls feet pregnant (Kathrin,Sonja).mpg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\xxx sleeping (Karin,Sonja).zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\brasilian trambling full movie (Samantha).zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\black fucking nude public boobs (Gina,Sandy).zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\action girls leather .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\handjob hidden boobs bedroom (Janette,Sonja).rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\horse horse lesbian circumcision .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\indian blowjob bukkake sleeping boobs bedroom .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files (x86)\Google\Temp\spanish lesbian full movie .mpg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files (x86)\Google\Update\Download\chinese fetish sleeping boobs .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files (x86)\Microsoft\Temp\EU5927.tmp\canadian gay public beautyfull .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\fetish fetish lesbian .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files\Microsoft Office\Updates\Download\lesbian blowjob [free] stockings .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\danish handjob blowjob lesbian .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\sperm cum catfight feet .mpg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\african porn lesbian (Liz,Janette).zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\african cumshot handjob girls stockings (Britney,Sonja).mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\russian xxx voyeur .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\russian lesbian lesbian big YEâPSè& .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\gay hot (!) YEâPSè& .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\sperm fucking [free] hole .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\italian gay hot (!) bedroom .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\trambling nude lesbian .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\brasilian action fucking lesbian (Janette,Christine).mpg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\gang bang cum [free] black hairunshaved (Karin,Tatjana).rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f8d34ba1b1eb00de\brasilian xxx [bangbus] leather .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\tyrkish nude lesbian several models ash .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\handjob hidden sweet (Melissa,Liz).zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\nude trambling hidden (Janette,Jenna).mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\brasilian kicking trambling hidden penetration .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\lingerie fucking [bangbus] leather .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\fucking kicking [milf] castration (Britney).avi.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\chinese fucking licking shoes (Samantha).rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\kicking public .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\russian cumshot masturbation shower .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\danish action sleeping ash (Kathrin).rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\hardcore fetish masturbation mature .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\cum voyeur YEâPSè& (Britney).avi.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\spanish fucking horse voyeur gorgeoushorny .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\bukkake big traffic .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\norwegian trambling horse girls titts .mpg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\animal big blondie .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\cumshot sperm masturbation nipples shoes .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\russian animal full movie legs black hairunshaved .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\blowjob [free] bondage (Gina).mpg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\beast several models cock beautyfull (Samantha,Britney).mpg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\fetish horse licking .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\brasilian beast cumshot sleeping (Curtney).mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\hardcore sperm [free] 40+ .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\tyrkish hardcore fucking [bangbus] .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\beastiality horse uncut glans .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_e2f5ebbcec2d8fca\french lesbian nude catfight legs (Anniston).mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\chinese lesbian hidden shower (Christine).mpg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\gang bang catfight castration .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\black gang bang masturbation vagina shower .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\german handjob fetish hot (!) .mpg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\russian gay hot (!) granny .avi.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_c9ce604ef4cbf323\american porn kicking [free] .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\Temp\fucking porn [bangbus] glans sweet (Ashley).rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\assembly\temp\malaysia lingerie fucking lesbian bondage .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\malaysia animal sperm catfight shoes .mpg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\animal hardcore lesbian Ôï .mpg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\gang bang licking sm .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\beast bukkake hidden nipples high heels .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\beastiality trambling sleeping wifey .mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\russian kicking sleeping glans circumcision (Melissa,Sylvia).mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\indian hardcore gang bang full movie glans (Janette).zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\blowjob action voyeur .avi.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\russian cum hot (!) balls .zip.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\InstallTemp\american beast public shoes (Sonja,Anniston).rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\american animal beastiality uncut .avi.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\fetish trambling big upskirt (Jade).mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\mssrv.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\cum lingerie masturbation shoes (Britney,Karin).mpeg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\japanese cumshot [milf] bondage .rar.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\asian horse catfight hotel .avi.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\beastiality full movie .mpg.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\gay [bangbus] boobs granny .avi.exe 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 652 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 652 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 652 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 652 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 652 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 652 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 652 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 652 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 652 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 652 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 652 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 652 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 652 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 652 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 3116 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4476 wrote to memory of 3804 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 92 PID 4476 wrote to memory of 3804 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 92 PID 4476 wrote to memory of 3804 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 92 PID 4476 wrote to memory of 3116 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 93 PID 4476 wrote to memory of 3116 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 93 PID 4476 wrote to memory of 3116 4476 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 93 PID 3804 wrote to memory of 652 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 94 PID 3804 wrote to memory of 652 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 94 PID 3804 wrote to memory of 652 3804 03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe"C:\Users\Admin\AppData\Local\Temp\03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe"C:\Users\Admin\AppData\Local\Temp\03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe"C:\Users\Admin\AppData\Local\Temp\03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:652
-
-
-
C:\Users\Admin\AppData\Local\Temp\03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe"C:\Users\Admin\AppData\Local\Temp\03b0ab1419f7debf0717371c1ae248671dc61b11f2ccc713023008f1de3e7486.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3116
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\black fucking nude public boobs (Gina,Sandy).zip.exe
Filesize1.9MB
MD590545b2ba9b98386c4285082cfb4daf9
SHA11500d10b39c82186fffe80031527c36e9ddd1008
SHA256be7078f6af273f84cdc1907e44225b36de9bfb622297b6d3120ca20c96c9aa2b
SHA51227a39ac43e18b6a5595feb607566cc7a134e80cb6d09ca59f18084661771f6ca5799b05bfdf70be5c51b2aeb06abfbdd23ed7b88e45c061f420f08fcf397ae5a