Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 18:27
Behavioral task
behavioral1
Sample
1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe
Resource
win10v2004-20240226-en
General
-
Target
1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe
-
Size
931KB
-
MD5
5fed3492e636f5e25aa1d9287c25fd36
-
SHA1
dd074d7956e5a770104f31f9a3cc4444b5b53e2f
-
SHA256
1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa
-
SHA512
e814f09523b92c9c5378f0e7983d38f83c024307df69bdb228f75eedd08c2f3d0758e0e8f0bd5bee3cc4a1c12127d87a4a340b98888eed7eb85ddc7fd4b18163
-
SSDEEP
24576:CTbi7jJbJx7Qcj7R3zKtYtNSgCjTUvKKjHo906Ytr:3JbH0SR3zK0SgCfUmRYtr
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 16 IoCs
resource yara_rule behavioral2/memory/4104-177-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1060-178-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3516-179-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4104-181-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4104-186-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4104-195-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4104-198-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4104-202-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4104-205-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4104-208-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4104-211-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4104-214-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4104-217-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4104-231-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4104-234-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4104-237-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 18 IoCs
resource yara_rule behavioral2/memory/4104-0-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/files/0x00090000000231be-5.dat UPX behavioral2/memory/4104-177-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/1060-178-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/3516-179-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4104-181-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4104-186-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4104-195-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4104-198-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4104-202-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4104-205-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4104-208-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4104-211-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4104-214-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4104-217-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4104-231-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4104-234-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4104-237-0x0000000000400000-0x000000000041F000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4104-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x00090000000231be-5.dat upx behavioral2/memory/4104-177-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1060-178-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3516-179-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4104-181-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4104-186-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4104-195-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4104-198-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4104-202-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4104-205-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4104-208-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4104-211-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4104-214-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4104-217-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4104-231-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4104-234-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4104-237-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\L: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\O: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\P: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\Z: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\H: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\N: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\U: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\V: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\X: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\Y: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\A: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\E: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\T: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\B: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\G: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\I: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\K: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\M: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\Q: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\R: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\S: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File opened (read-only) \??\W: 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\SHARED\gang bang [free] (Jenna,Sarah).avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\trambling beastiality [milf] (Curtney).rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\SysWOW64\config\systemprofile\tyrkish xxx xxx hidden hotel .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\System32\DriverStore\Temp\horse licking ¼ë .mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\SysWOW64\IME\SHARED\trambling sperm [free] ash .rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\beast nude [bangbus] black hairunshaved .rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\SysWOW64\config\systemprofile\kicking beastiality licking hole young .mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\SysWOW64\FxsTmp\german cum uncut .zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\blowjob lingerie hot (!) hole .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\SysWOW64\FxsTmp\swedish beastiality licking .zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\japanese lesbian nude lesbian young (Gina,Samantha).rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\japanese cumshot hidden .mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\japanese fucking lesbian feet .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files (x86)\Google\Temp\swedish gang bang [milf] nipples .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files\dotnet\shared\japanese kicking uncut 40+ (Karin).zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files\Microsoft Office\root\Templates\sperm fetish several models legs .mpg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files\Microsoft Office\Updates\Download\french animal masturbation fishy .zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\tyrkish xxx [bangbus] .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\sperm several models YEâPSè& (Curtney).mpg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\horse masturbation .zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files\Common Files\microsoft shared\sperm sleeping gorgeoushorny .mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\french animal uncut redhair .mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\beastiality sleeping vagina .mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\british beastiality fetish big sm (Liz,Liz).zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\black cum [free] glans boots (Sonja,Janette).rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\gay hidden lady .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\sperm voyeur wifey (Britney,Janette).avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files (x86)\Google\Update\Download\chinese horse catfight .mpg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files (x86)\Microsoft\Temp\beastiality uncut glans (Sylvia).mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\cum licking ejaculation (Sonja).mpg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\blowjob nude public YEâPSè& .mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\italian gay bukkake hot (!) .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\american beast hot (!) boobs balls .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\mssrv.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\sperm uncut titts gorgeoushorny .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\beastiality masturbation ash fishy (Sandy).mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\kicking lesbian hot (!) hotel (Sonja,Ashley).mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\russian hardcore [bangbus] .rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\beastiality cum full movie shower .mpg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\bukkake gang bang girls lady .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\gay handjob hot (!) (Christine).avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\indian fetish fetish licking (Jade).mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\russian gang bang catfight (Sylvia,Curtney).avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\danish fucking public balls .zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_e2f5ebbcec2d8fca\british bukkake uncut .mpg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\norwegian cum blowjob masturbation lady (Kathrin).mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\gang bang hardcore girls .mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\black lingerie [bangbus] vagina .mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\german horse girls titts mistress .zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\animal hidden nipples bedroom .zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\japanese fetish masturbation ash wifey .mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\french lesbian full movie balls .mpg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\beastiality gang bang several models .zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\asian fucking hot (!) sm .rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\italian xxx uncut .rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\spanish beastiality hardcore masturbation .rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\african porn sleeping .rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\tyrkish blowjob licking ash upskirt (Liz).avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\asian sperm nude girls 40+ .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\SoftwareDistribution\Download\malaysia lingerie kicking [free] .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\horse lingerie licking nipples sweet (Sonja,Gina).mpg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\malaysia horse sleeping 40+ (Sarah).mpg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\indian action cumshot big .zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\lingerie [bangbus] YEâPSè& .mpg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\handjob hardcore sleeping \Û .rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\danish horse kicking public .mpg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\black action horse hidden glans (Sarah).mpg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\Downloaded Program Files\gay fucking catfight .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\german beast catfight .mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\action [bangbus] shoes (Ashley).avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_b201c2e68d8dbc0d\russian animal [free] ash blondie .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\assembly\temp\canadian blowjob gay girls Ôï .zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\beastiality animal hot (!) cock .rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\animal trambling hot (!) cock young .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\x86_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_231ddfc33015c6db\cumshot blowjob licking .zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\indian horse gang bang lesbian latex .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\spanish action beast public cock (Sarah,Ashley).rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\animal lingerie hot (!) (Sandy).zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\japanese bukkake nude licking redhair .rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\swedish nude licking (Christine).mpg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\nude sleeping YEâPSè& .rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\PLA\Templates\british cum hidden stockings (Tatjana,Janette).zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\spanish action beast voyeur fishy (Tatjana).zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\hardcore licking .rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\fucking [bangbus] beautyfull (Gina,Christine).rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\indian xxx voyeur redhair .rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\beastiality cum big beautyfull .mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\american handjob licking legs wifey .rar.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\brasilian fetish hardcore hidden (Jade,Anniston).mpg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\norwegian cumshot several models titts shoes .avi.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\african action voyeur circumcision (Sonja).zip.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\indian kicking animal girls (Janette).mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\sperm beastiality [bangbus] pregnant (Britney).mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\brasilian fucking fetish voyeur .mpeg.exe 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 3516 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4104 wrote to memory of 1060 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 91 PID 4104 wrote to memory of 1060 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 91 PID 4104 wrote to memory of 1060 4104 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 91 PID 1060 wrote to memory of 3516 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 92 PID 1060 wrote to memory of 3516 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 92 PID 1060 wrote to memory of 3516 1060 1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe"C:\Users\Admin\AppData\Local\Temp\1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe"C:\Users\Admin\AppData\Local\Temp\1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe"C:\Users\Admin\AppData\Local\Temp\1f7655304aa726f017a0bffe86506188f80e88ced5e8505313e536258016c9aa.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3516
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\gay hidden lady .avi.exe
Filesize1.6MB
MD592999ef24df7867833c76d72366234d9
SHA1f8e2677d1eae98b7a2882153441cbe11888b9f18
SHA25648d54458d11d0cb96610932fc45d9210908d7dc54c672c66f14fa4a998f5b5bb
SHA51260e8aef698ba986def5cc94376f2b117d98ffb3c92d2185a072fa6c3628c9c2dba97154762f83fcd9509abf874d1a607bf975d52a0ebd4359c820580af26c6df