Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/04/2024, 19:19
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe
- Size 416KB
- Sample240403-x1zzysaf33
- SHA256 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b
- MD5 04db70fb6f07eb144fa200f40af44916
- SHA1 a955aec031ebcd6726cb36d90468aceff943d700
- SHA512 e77f4624a03e4d6aa85c96bd0666aeb074eaf2fd6cb15d6ceb583e66741423ba033616688d30130aa25a7fd5e582c49e66482734c13665da1222133216560429
- SSDEEP 6144:aDOxZXrSHXUTsGVJ3feZzXuhTgP8ccGnw6t/RjXCgCUhoilu8WvJEC3YT7L7YIuS:lXa8sGVjBg1wcy1CShw3YIuVRPLq
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Detects executables containing possible sandbox analysis VM usernames 16 IoCs
resource yara_rule behavioral2/memory/3160-186-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2656-187-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2616-188-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3160-190-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3160-191-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3160-196-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3160-208-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3160-212-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3160-215-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3160-218-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3160-221-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3160-224-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3160-227-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3160-230-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3160-233-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3160-236-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames - UPX dump on OEP (original entry point) 18 IoCs
resource yara_rule behavioral2/memory/3160-0-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/files/0x000300000002276e-5.dat UPX behavioral2/memory/3160-186-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2656-187-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2616-188-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3160-190-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3160-191-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3160-196-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3160-208-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3160-212-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3160-215-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3160-218-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3160-221-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3160-224-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3160-227-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3160-230-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3160-233-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3160-236-0x0000000000400000-0x000000000041C000-memory.dmp UPX - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\I: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\S: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\Y: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\V: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\W: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\X: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\A: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\E: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\G: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\N: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\Q: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\M: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\O: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\R: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\U: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\T: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\Z: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\H: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\J: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\K: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\L: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File opened (read-only) \??\P: 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\blowjob action hot (!) .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\japanese cum handjob masturbation glans (Sylvia,Sonja).rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\System32\DriverStore\Temp\african lesbian [free] (Tatjana,Karin).mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\SysWOW64\IME\SHARED\horse public redhair (Sandy,Tatjana).avi.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\porn [bangbus] tß (Karin).mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\norwegian handjob porn catfight sweet (Tatjana).zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\SysWOW64\FxsTmp\beastiality girls nipples fishy (Curtney,Sonja).avi.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\SysWOW64\IME\SHARED\lesbian big .rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\SysWOW64\config\systemprofile\handjob voyeur .mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\SysWOW64\FxsTmp\lesbian xxx sleeping legs (Anniston,Janette).mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\indian bukkake cum girls .zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\SysWOW64\config\systemprofile\cumshot sleeping ash .avi.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe - Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\handjob licking swallow .mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\gang bang beast hidden .rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files (x86)\Google\Temp\german cumshot nude voyeur traffic (Sylvia,Karin).mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\porn uncut gorgeoushorny .mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files (x86)\Microsoft\Temp\german sperm action sleeping cock .rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\tyrkish blowjob sleeping nipples ejaculation .mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files\Common Files\microsoft shared\british handjob [milf] glans .mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files\dotnet\shared\tyrkish cumshot full movie nipples young (Janette).mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\black trambling porn several models legs sweet .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\gay voyeur hotel (Jade,Melissa).rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\norwegian cumshot action masturbation .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\gay fetish masturbation .avi.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\italian trambling hot (!) hotel .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\beastiality hot (!) .rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\asian blowjob lesbian voyeur redhair .rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files (x86)\Google\Update\Download\cum fetish hidden fishy .avi.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files\Microsoft Office\root\Templates\fucking [free] .mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Program Files\Microsoft Office\Updates\Download\german trambling public gorgeoushorny .rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\trambling horse masturbation glans .zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\danish bukkake lingerie girls legs .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\sperm hidden .zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\handjob beastiality hidden beautyfull .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\brasilian kicking lingerie big boobs .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\chinese beastiality hot (!) glans .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\canadian sperm gang bang hot (!) wifey .mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\canadian action [bangbus] (Liz).zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\gay gang bang [free] mistress .avi.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\norwegian fetish action hot (!) feet granny .rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_4ab14109a3e1e067\black fetish several models sweet .avi.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\russian hardcore horse big black hairunshaved .zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\tyrkish nude bukkake catfight bondage .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\american kicking lesbian hidden ash .mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\kicking [bangbus] black hairunshaved .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\blowjob [bangbus] (Jenna).zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\canadian horse cumshot hot (!) .rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\french animal sperm sleeping feet castration (Jenna,Melissa).avi.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\trambling cum sleeping hole 40+ .mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_c9ce604ef4cbf323\horse hot (!) (Britney,Kathrin).mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_it-it_1a80ce63d483fe70\lingerie lesbian uncut high heels (Sandy).mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\mssrv.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\PLA\Templates\asian horse full movie black hairunshaved .rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\gay gay licking leather .zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\italian sperm lesbian mistress .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\lingerie licking nipples granny (Christine).mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\cumshot horse uncut (Tatjana,Melissa).rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\black hardcore action masturbation young (Curtney).mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_a4327320c19e2fa7\french porn cum girls vagina black hairunshaved .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\chinese horse cumshot hidden bondage (Janette).mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\british horse lesbian high heels (Jenna).avi.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\xxx licking bedroom (Sandy).zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\chinese sperm bukkake [bangbus] .avi.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\british cum action hot (!) .mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\german lesbian lingerie sleeping balls .mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\sperm bukkake hidden wifey .zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\fucking xxx [milf] traffic (Jade,Sonja).zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\canadian action licking YEâPSè& .rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\italian bukkake horse voyeur (Anniston,Curtney).rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\beastiality beastiality [free] redhair (Tatjana).rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\brasilian handjob catfight stockings (Sylvia).rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\kicking fucking several models titts (Tatjana).rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.1_none_813610a8a9b59e0a\indian cum [free] .avi.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\fucking action uncut hole .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\cum full movie .zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\swedish bukkake cumshot lesbian ash mistress .zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\german cumshot gay licking wifey .avi.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\french animal full movie penetration (Sandy,Sonja).zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\kicking handjob uncut 50+ .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\cum kicking lesbian ash .mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\action hidden legs .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_93c5f32b7859ec4f\black bukkake hot (!) (Sarah,Christine).zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.1_none_5a23b464e1e0b15e\russian lesbian sleeping mistress .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\InstallTemp\japanese hardcore xxx [bangbus] glans (Sylvia).rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\swedish beast catfight gorgeoushorny .rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\black porn beastiality [free] (Ashley,Anniston).avi.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\russian fucking fetish several models feet .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\danish handjob lesbian blondie .mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\chinese gay full movie titts .avi.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\spanish horse gang bang full movie (Samantha).mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\malaysia hardcore licking vagina .mpeg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\bukkake [milf] mistress (Ashley,Karin).zip.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\italian cum hot (!) balls (Karin,Jenna).rar.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\canadian beastiality uncut leather .mpg.exe 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 2616 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3160 wrote to memory of 2656 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 89 PID 3160 wrote to memory of 2656 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 89 PID 3160 wrote to memory of 2656 3160 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 89 PID 2656 wrote to memory of 2616 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 92 PID 2656 wrote to memory of 2616 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 92 PID 2656 wrote to memory of 2616 2656 20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe"C:\Users\Admin\AppData\Local\Temp\20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe"C:\Users\Admin\AppData\Local\Temp\20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe"C:\Users\Admin\AppData\Local\Temp\20becae7e56f7ff390ef06a07762528dd0251c98fb9f368e4aef42228079894b.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2616
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\handjob licking swallow .mpeg.exe
- Size 2.0MB
- SHA256 7f115586b1c251dfb82379c3c64308265fd1d8557c69769d6ba48ba7a99ec639
- MD5 7da2e26ff2ae70eb8ca6b2541d47603a
- SHA1 26c72634af55d12f9887ef57c704c7f074109de3
- SHA512 60faf4a3555fda06d394104d7d3d521d3260f267e9aa69e6bddf56742e1ddc662dfbf5f5abd890747a23c1d1e9cd60114ac3ffe71fe4840dd6512487d3712eb3
- SSDEEP 49152:5nRRwK6oGmQQ7ZH/b0u8KVbtXLAs0W/TJyZcwcC2MPcZihPN:5nRqKBfQQ7VA9KhRcBW/TQOwcCHUOl
- MD5 SHA1 SHA512 SSDEEP