Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2024, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe
Resource
win10v2004-20231215-en
General
-
Target
21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe
-
Size
385KB
-
MD5
1510c7e79d87db55f1a78fbc9349ad14
-
SHA1
b8e0ea6ea4da8c22a56acbe968d2b3d530be4859
-
SHA256
21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b
-
SHA512
7131a2a990f0dc77f5aa8c67e135317e6cc1146834ade0c443d2cb727e380abbc38b251e55d79970fedb0e88cd3058b0dc04ffc87c96004d20f1a77af6ef88cc
-
SSDEEP
6144:dXC4vgmhbIxs3NBB/EM4D7sJ5XyeY9+BpTNoSJ3/6bY0wAqMQ+vM0vi0ipad4O6i:dXCNi9BGMJ7nVF/60kqMVrvirs59
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 4 IoCs
resource yara_rule behavioral2/memory/2244-0-0x0000000000400000-0x000000000042B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/files/0x000600000002321e-5.dat INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1908-44-0x0000000000400000-0x000000000042B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3712-165-0x0000000000400000-0x000000000042B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\O: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\Q: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\T: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\I: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\K: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\M: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\U: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\V: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\W: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\Y: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\A: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\E: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\G: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\J: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\L: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\N: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\P: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\R: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\B: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\S: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\X: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File opened (read-only) \??\Z: 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\horse licking balls .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\IME\SHARED\xxx licking cock mature .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\brasilian beastiality trambling [bangbus] .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\config\systemprofile\gay masturbation feet black hairunshaved .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\IME\SHARED\tyrkish kicking blowjob [free] swallow .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\swedish handjob hardcore catfight balls .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\lesbian hot (!) feet redhair (Janette).zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\config\systemprofile\blowjob catfight feet .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\FxsTmp\japanese cumshot hardcore girls glans girly (Janette).rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\horse [free] traffic .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\gay several models fishy .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SysWOW64\FxsTmp\lesbian [milf] titts upskirt (Janette).zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Templates\russian fetish lingerie public .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\xxx full movie Œã .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\brasilian kicking fucking masturbation feet lady (Samantha).mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Microsoft\Temp\american gang bang gay hidden cock (Sonja,Janette).zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\russian horse hardcore uncut (Melissa).avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\danish action hardcore licking titts black hairunshaved (Liz).mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\brasilian porn lingerie public feet upskirt (Janette).rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\russian horse gay hot (!) hairy .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\japanese fetish bukkake hot (!) upskirt .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Google\Temp\black gang bang sperm masturbation (Samantha).mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files\Common Files\microsoft shared\horse big cock .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files\dotnet\shared\indian porn sperm uncut YEâPSè& .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\lesbian full movie feet (Sandy,Sylvia).mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files\Microsoft Office\Updates\Download\swedish kicking horse voyeur feet wifey (Curtney).mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\hardcore licking hole leather .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Google\Update\Download\indian gang bang xxx hot (!) shoes .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\lingerie public .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\brasilian handjob xxx sleeping (Curtney).zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\security\templates\tyrkish cum fucking masturbation titts pregnant (Janette).rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\trambling girls .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\norwegian fucking big glans sm .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\swedish handjob fucking voyeur .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\british lingerie voyeur (Sarah).zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\lesbian full movie titts sm .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\african horse public sweet .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\sperm hot (!) cock .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\xxx [bangbus] hole penetration (Karin).mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\italian nude xxx lesbian (Samantha).avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\black beastiality blowjob catfight balls .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bca64d70c79f104b\fetish fucking full movie penetration .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\african lingerie uncut titts (Sandy,Sarah).rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\hardcore public titts black hairunshaved .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\brasilian handjob beast uncut .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\black nude hardcore voyeur hole .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\asian horse [bangbus] feet .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\trambling full movie upskirt .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\italian handjob xxx hidden high heels (Anniston,Janette).rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\norwegian lesbian lesbian (Janette).mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\swedish animal blowjob licking lady .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.1_none_813610a8a9b59e0a\blowjob [free] titts sweet (Janette).zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_d980e9752d51efac\blowjob big (Liz).rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\chinese beast sleeping granny .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\animal trambling big hole Ôï .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\chinese trambling licking bedroom (Sonja,Melissa).mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\japanese beastiality blowjob licking swallow .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_c9ce604ef4cbf323\lesbian hidden feet shower (Jade).mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\bukkake voyeur sm (Sandy,Jade).rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\japanese kicking lingerie [bangbus] balls .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\italian horse beast masturbation hole .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\norwegian blowjob [bangbus] hole bedroom (Janette).zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\asian lesbian [bangbus] cock beautyfull (Curtney).zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\fetish horse several models cock .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_a4327320c19e2fa7\norwegian lingerie hidden cock redhair .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\PLA\Templates\xxx hidden .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\indian action hardcore masturbation glans .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\canadian horse catfight castration .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\spanish lingerie hidden cock blondie .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\hardcore hidden .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\tyrkish beastiality hardcore [free] feet traffic .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\danish action fucking licking titts .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\british lingerie licking shoes .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\swedish porn gay hidden (Jade).mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\spanish blowjob hot (!) titts YEâPSè& (Samantha).rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\tyrkish kicking sperm [bangbus] titts ash .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\italian action gay full movie bedroom .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\hardcore voyeur fishy .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\gay voyeur (Jade).rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\spanish trambling several models .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\african bukkake sleeping .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\swedish cumshot lingerie voyeur high heels .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\spanish gay licking feet mistress (Curtney).mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\brasilian beastiality trambling [milf] sm .mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\black horse fucking [milf] .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\danish gang bang beast full movie glans shoes (Sarah).mpg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\Temp\indian kicking hardcore [free] latex .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\japanese action sperm uncut cock .zip.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\blowjob licking penetration .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\kicking sperm licking .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\cum sperm catfight Ôï .rar.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_4ab14109a3e1e067\spanish trambling catfight bondage .avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\beast girls leather .mpeg.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\action hardcore masturbation penetration (Jenna,Liz).avi.exe 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2976 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2976 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2976 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2976 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2976 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2976 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2976 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2976 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2976 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2976 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2976 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2976 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2976 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2976 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 3712 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2244 wrote to memory of 1908 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 84 PID 2244 wrote to memory of 1908 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 84 PID 2244 wrote to memory of 1908 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 84 PID 2244 wrote to memory of 3712 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 85 PID 2244 wrote to memory of 3712 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 85 PID 2244 wrote to memory of 3712 2244 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 85 PID 1908 wrote to memory of 2976 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 86 PID 1908 wrote to memory of 2976 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 86 PID 1908 wrote to memory of 2976 1908 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2976
-
-
-
C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\lesbian full movie feet (Sandy,Sylvia).mpeg.exe
Filesize1.9MB
MD51d29952cd372fbece9f22944f3c4d116
SHA1ae25625bcd24834f4e19457d1bd3b14ddb278aee
SHA25658de123f1cb3efc1f3840557db6ae92b87c60558b08e31143c58a93e0b3ea767
SHA512b60ee6db46a565a6cf70d9ab76e673d39ed2da988e24a711c51a900eef7ba02f797188d9fea80b54b5145d717ead84d7db9a3026ded7616683e9f1edb0f4bcd7