Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2024, 19:05
Behavioral task
behavioral1
Sample
1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe
Resource
win10v2004-20240226-en
General
-
Target
1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe
-
Size
332KB
-
MD5
2c7509903bc0eade4f46babbfccb21f2
-
SHA1
7085ca3f6ee7b953f01259586e9b900b42e4cdd0
-
SHA256
1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b
-
SHA512
6680b60a2ee0e8363c4b76426bc2b332eb7b377ffd701ad3262b75f06d024b6c634e8587dd75a5fae1aeefb17d8bf0a72977ce1f90e02c4e33d13c90066af29a
-
SSDEEP
6144:bjluQoSsqaxIo5R4nM/Thz5bdboSK9OHAl5SjRfraLPhPRgqllyTPCYwjKpFGyNS:bEQoSx0q2ZfKsgLS9frghGqjyTPojKPQ
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
resource yara_rule behavioral2/memory/856-162-0x0000000000400000-0x0000000000429000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral2/memory/960-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000e00000002314a-5.dat UPX behavioral2/memory/4836-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4080-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/856-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/960-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000e00000002314a-5.dat upx behavioral2/memory/4836-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-162-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\H: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\O: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\P: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\K: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\Q: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\S: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\W: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\B: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\I: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\L: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\M: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\N: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\R: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\X: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\Y: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\Z: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\E: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\G: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\J: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\T: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\U: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File opened (read-only) \??\V: 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\lesbian public vagina wifey .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\FxsTmp\italian fetish hot (!) fishy .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\animal cumshot uncut ash .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\config\systemprofile\canadian fucking sperm [free] black hairunshaved .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\IME\SHARED\canadian blowjob sleeping pregnant .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\black cum trambling [milf] glans sweet .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\config\systemprofile\gang bang animal [milf] vagina 40+ .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\IME\SHARED\lingerie uncut balls (Gina).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\nude lingerie sleeping glans .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\swedish gay fetish lesbian redhair .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\FxsTmp\beast nude lesbian glans (Ashley,Sonja).rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\kicking porn voyeur cock traffic .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Templates\spanish blowjob [milf] (Anniston).mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Google\Update\Download\bukkake hot (!) shoes .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Microsoft\Temp\fetish hot (!) redhair .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\italian horse lesbian wifey .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\danish bukkake action uncut \Û .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\horse lesbian .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files\Microsoft Office\Updates\Download\hardcore uncut .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\hardcore hidden .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\horse lingerie [milf] girly .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\action masturbation pregnant .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Google\Temp\hardcore sperm [milf] titts .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\porn gang bang lesbian blondie .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files\Common Files\microsoft shared\beastiality animal hot (!) hole sm .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\gang bang lesbian titts (Tatjana).mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\kicking nude uncut titts circumcision (Curtney,Samantha).avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files\dotnet\shared\danish nude hidden .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\russian blowjob cumshot hot (!) redhair .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\malaysia animal [free] boobs Ôï .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\tyrkish fucking action [milf] .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\japanese gay beastiality licking .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\sperm full movie titts (Anniston).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\chinese action hardcore masturbation boobs .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\security\templates\russian cum gay voyeur boots .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\beastiality sleeping swallow .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\xxx beastiality catfight swallow .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\gay catfight titts hotel (Janette).mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\malaysia gang bang porn uncut .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\cumshot handjob [milf] ash .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\fetish lingerie sleeping hotel (Anniston,Karin).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\porn horse [milf] (Liz,Liz).mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\japanese fetish hidden legs balls .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\tyrkish xxx blowjob hidden cock mature (Britney).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\mssrv.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\black lesbian nude big glans hairy .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\sperm fetish catfight (Anniston).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\american bukkake voyeur black hairunshaved .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_c9ce604ef4cbf323\sperm beastiality public (Sonja,Sylvia).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\canadian handjob bukkake public 50+ .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\cum [bangbus] boobs gorgeoushorny .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\italian lingerie several models vagina fishy .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.1_none_813610a8a9b59e0a\nude horse lesbian gorgeoushorny .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\beast [milf] (Sylvia).avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\american gay voyeur .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\american fucking beastiality hot (!) bedroom .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\italian beast full movie boobs hotel .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\indian horse lingerie [milf] titts leather (Sarah,Tatjana).rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\spanish fetish bukkake big cock (Janette,Anniston).rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\canadian gang bang animal full movie swallow .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\xxx gay girls hairy .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\beastiality nude hot (!) titts circumcision .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\german cum licking ash .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\animal uncut ash latex (Curtney).mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\handjob bukkake uncut .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\action animal catfight penetration .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\chinese action hardcore hidden YEâPSè& .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\PLA\Templates\bukkake voyeur upskirt (Curtney,Sandy).mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\malaysia kicking lingerie hot (!) (Ashley).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\french lingerie xxx public .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\swedish sperm [milf] femdom .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\horse [milf] feet .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\porn gang bang big fishy .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\brasilian sperm sperm hot (!) Ôï (Curtney,Janette).zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\american trambling uncut titts .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\japanese beastiality catfight .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\canadian beastiality licking .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\british trambling gay catfight boobs ejaculation (Janette).rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\cumshot lesbian full movie ash .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\malaysia handjob beastiality several models cock hairy .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\black beastiality fucking licking boobs stockings (Janette,Britney).rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\cumshot [free] .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\swedish fetish public (Jenna,Sonja).rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\porn fucking [bangbus] titts shower .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\trambling cumshot catfight .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\Temp\malaysia fucking catfight shoes .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\bukkake girls vagina (Sonja,Sandy).mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\norwegian cumshot kicking licking beautyfull (Sonja,Sandy).rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\american fetish masturbation legs .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\brasilian animal voyeur .mpg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\african cum lesbian .avi.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\brasilian xxx [free] boobs redhair .zip.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.1_none_5a23b464e1e0b15e\british animal kicking [free] bedroom .mpeg.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\gang bang gay hidden redhair .rar.exe 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 856 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 856 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 856 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 856 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 856 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 856 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 856 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 856 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 856 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 856 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 856 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 856 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 856 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 856 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 4080 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 960 wrote to memory of 4836 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 90 PID 960 wrote to memory of 4836 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 90 PID 960 wrote to memory of 4836 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 90 PID 960 wrote to memory of 4080 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 91 PID 960 wrote to memory of 4080 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 91 PID 960 wrote to memory of 4080 960 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 91 PID 4836 wrote to memory of 856 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 92 PID 4836 wrote to memory of 856 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 92 PID 4836 wrote to memory of 856 4836 1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe"C:\Users\Admin\AppData\Local\Temp\1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe"C:\Users\Admin\AppData\Local\Temp\1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe"C:\Users\Admin\AppData\Local\Temp\1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:856
-
-
-
C:\Users\Admin\AppData\Local\Temp\1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe"C:\Users\Admin\AppData\Local\Temp\1a88a76e65ae59b5e70300048bcb2425db14698ceff32a6d9878d8422610438b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\gang bang lesbian titts (Tatjana).mpeg.exe
Filesize2.0MB
MD5a4bd81082bd8258ee71460744a921c9d
SHA1ca89e00f4f774cbbb48e5dce286ff6a9a2488a3c
SHA256d4c2d730d4536e85a2ec1a0ab7ff0c7b2f0c2a15042664c7de8c2b097086dffb
SHA5129409257bbe2f1e0a66892a041796354cd5f45b770aa4a62b7e1b70afa2f81c1e617676d4e8d6d2d1a97bcb59fc3d46b63774a64571310b07119d6ca0196f2fe5