Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2024, 18:24
Behavioral task
behavioral1
Sample
091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe
Resource
win10v2004-20240226-en
General
-
Target
091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe
-
Size
234KB
-
MD5
36ea4f0e5583c44848ba59ef59350806
-
SHA1
c9f18716291ca8cd2772e91eacd98ce7ca8abe6b
-
SHA256
091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5
-
SHA512
19a084c812985d7e9a2c20aff3d01583bbcd87b219f9dd1ef5e27f84ef770f2da6b886a605901f962ec0b1ef47078e790bc27ca9430d030766ceed2f3e3b1d52
-
SSDEEP
6144:YjluQoSPIo5R4nM/40yJN1O2X0FTGoqqPMzjgZ4P6wlUwehSfs:YEQoSpqhv3XmGDiMPgZ1bhSk
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 5 IoCs
resource yara_rule behavioral2/memory/3012-166-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2540-194-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4704-197-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3012-198-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4252-200-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral2/memory/2540-0-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/files/0x0007000000023201-5.dat UPX behavioral2/memory/4704-92-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3012-166-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/4252-167-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/2540-194-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/4704-197-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3012-198-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/4252-200-0x0000000000400000-0x0000000000420000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/2540-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x0007000000023201-5.dat upx behavioral2/memory/4704-92-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3012-166-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4252-167-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2540-194-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4704-197-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3012-198-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4252-200-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\M: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\P: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\U: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\W: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\Y: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\A: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\I: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\L: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\S: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\X: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\H: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\O: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\T: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\K: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\G: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\J: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\N: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\Q: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\R: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\V: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\Z: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File opened (read-only) \??\E: 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\FxsTmp\nude xxx girls .zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\norwegian porn [bangbus] ash .avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\SysWOW64\config\systemprofile\chinese handjob kicking public boots .zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\SysWOW64\FxsTmp\horse sperm licking hole (Kathrin).mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\SysWOW64\IME\SHARED\german fucking fetish [free] ash .zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\british fucking [milf] ash sweet .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\SysWOW64\config\systemprofile\norwegian blowjob horse uncut vagina ash (Ashley,Karin).mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\System32\DriverStore\Temp\russian beastiality big fishy .zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\SysWOW64\IME\SHARED\blowjob [free] YEâPSè& .rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\british lingerie cumshot voyeur stockings .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\german sperm masturbation (Liz).avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\black trambling hot (!) ejaculation (Christine).zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\Shared Gadgets\gay trambling uncut mistress .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\chinese cum beastiality hot (!) mistress .mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\lesbian lingerie big cock (Sarah).rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files\Microsoft Office\Updates\Download\handjob several models gorgeoushorny (Melissa).mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\beast big .mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\fetish sleeping granny (Britney,Kathrin).avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\hardcore gang bang [bangbus] titts stockings .avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\gang bang lingerie full movie upskirt .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\japanese fetish several models .rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files (x86)\Google\Temp\nude hardcore full movie latex (Janette).mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files (x86)\Microsoft\Temp\swedish beast voyeur leather .avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files\dotnet\shared\japanese sperm lesbian high heels .zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files\Microsoft Office\root\Templates\xxx xxx lesbian .zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\blowjob full movie vagina (Ashley).mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files (x86)\Google\Update\Download\norwegian xxx bukkake masturbation glans .mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files\Common Files\microsoft shared\malaysia fetish hidden (Ashley,Sandy).mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\nude lesbian swallow .rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\cum beast hidden (Janette,Christine).mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\InstallTemp\japanese xxx cumshot [milf] legs .avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\german animal horse hot (!) (Kathrin).rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\trambling nude catfight sm .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\tyrkish lingerie handjob hot (!) titts .avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\mssrv.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\american blowjob hidden titts penetration (Sylvia,Jenna).mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\norwegian fucking licking bondage (Kathrin).avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\tyrkish lesbian uncut .avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\black nude kicking hot (!) vagina mistress (Anniston,Anniston).rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\black trambling hot (!) .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\brasilian handjob big penetration (Gina).rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\sperm cum sleeping (Tatjana).zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\gay masturbation vagina sm (Jade,Karin).avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\cum uncut 50+ (Christine).mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\cum [milf] hotel (Anniston).avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\danish porn lesbian (Liz,Karin).avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\lingerie lesbian [milf] 50+ .mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\kicking cumshot full movie boots .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\german fucking voyeur YEâPSè& (Sylvia).mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\bukkake girls cock (Sarah,Christine).avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\black horse action girls black hairunshaved .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\assembly\temp\horse sleeping sm .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\french cum big circumcision (Curtney).mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\blowjob hardcore [milf] glans .zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\gang bang trambling hidden hole (Sarah).mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\CbsTemp\nude big mistress .mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\african lingerie kicking several models boobs .avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\british gay masturbation shower (Ashley).mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\chinese lingerie nude several models 40+ .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\sperm [milf] boobs balls .mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_4ab14109a3e1e067\danish lesbian trambling full movie nipples balls .rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\canadian porn beastiality [milf] circumcision (Janette).rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\german animal cum public redhair (Karin).zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\kicking several models bedroom .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\horse hot (!) feet fishy .rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataoraclec.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_3b8d4dacc2ea6b71\french gang bang public mature .rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\SoftwareDistribution\Download\canadian fucking voyeur nipples .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\japanese cumshot public lady .mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\chinese fetish [milf] glans wifey .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\beastiality beastiality [bangbus] traffic .mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\norwegian hardcore sperm lesbian 40+ .rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\tyrkish horse lesbian licking .avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\porn trambling [milf] titts hairy .mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\cumshot [bangbus] traffic .mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\xxx full movie .zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\indian lesbian [milf] feet granny .mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\asian lingerie lesbian titts .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\german bukkake trambling [milf] nipples 40+ .rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\british fetish hidden cock (Janette,Gina).zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\sperm horse public circumcision (Jade).rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\american beastiality [bangbus] (Jade,Melissa).avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\american bukkake beastiality voyeur 50+ .mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\norwegian fucking fetish hot (!) castration .zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\PLA\Templates\animal catfight .mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\italian cumshot lingerie public Ôï .rar.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\african hardcore horse girls ash hairy .zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\norwegian handjob cum [free] vagina .zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\asian cumshot uncut lady .mpg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\chinese beast full movie feet young .zip.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\lingerie public hairy (Sarah,Samantha).mpeg.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\horse catfight fishy .avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\lesbian licking glans fishy .avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\african action nude girls glans sm .avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\british fetish hot (!) .avi.exe 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4252 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4252 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4252 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4252 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4252 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4252 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4252 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4252 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4252 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4252 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4252 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4252 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4252 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4252 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 3012 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2540 wrote to memory of 4704 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 90 PID 2540 wrote to memory of 4704 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 90 PID 2540 wrote to memory of 4704 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 90 PID 2540 wrote to memory of 3012 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 91 PID 2540 wrote to memory of 3012 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 91 PID 2540 wrote to memory of 3012 2540 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 91 PID 4704 wrote to memory of 4252 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 92 PID 4704 wrote to memory of 4252 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 92 PID 4704 wrote to memory of 4252 4704 091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe"C:\Users\Admin\AppData\Local\Temp\091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe"C:\Users\Admin\AppData\Local\Temp\091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe"C:\Users\Admin\AppData\Local\Temp\091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4252
-
-
-
C:\Users\Admin\AppData\Local\Temp\091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe"C:\Users\Admin\AppData\Local\Temp\091ca27bca23c9221911b2b6e44574173a4df0a0e00f5e59e15686be8e3b38e5.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\nude lesbian swallow .rar.exe
Filesize2.0MB
MD53d3e40026616360e0e514b4bb20f360b
SHA19b8f8186b3d44f7225442e35d2b8041b78882678
SHA2568c7ef2cb12a5e61ae810ba2cf9bc32fd8789c3a84fdaa21bde92b568eb32ba65
SHA51283354884bf0ef128c21fedff4b7730a0f4f736fc8482af68658d8682e6f32f88af36ffff4e3d51edf91e4984b1e3132474ae91fd7ca177de59325c8be5a122e2