Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe
Resource
win10v2004-20240226-en
General
-
Target
04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe
-
Size
1.6MB
-
MD5
05c27c72c9f8df2173c0736e5497cafd
-
SHA1
ed933acdb5d0f2c21c507637095ec76e37b48f4d
-
SHA256
04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963
-
SHA512
53a490eb56c107b39c92c971df2265f761196d676b436a6e5dc4f5c86c3a3d80cb0b66e6a8d5a7fc1ae2d010d589c58f3f03d1dede6d6ab9efb22d6fc22e9df6
-
SSDEEP
49152:5YsWYuqKoKOhsTC9Kc/R4IA1SA4UlfZk57cxJQ:WsWYZKoKOhg4//RVAxLfWVmy
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
resource yara_rule behavioral2/files/0x00070000000231fb-4.dat INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\U: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\X: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\Z: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\E: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\J: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\L: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\Q: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\V: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\B: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\H: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\M: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\N: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\P: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\S: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\Y: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\A: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\K: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\O: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\R: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\T: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\W: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File opened (read-only) \??\I: 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\FxsTmp\swedish porn several models hotel .rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\SysWOW64\config\systemprofile\chinese fetish sperm voyeur ash YEâPSè& .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\SysWOW64\FxsTmp\lingerie kicking [milf] traffic .rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\beastiality beast hot (!) boots .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\african horse fucking hot (!) YEâPSè& .rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\swedish blowjob [bangbus] wifey .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\SysWOW64\IME\SHARED\indian animal [milf] castration .rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\asian blowjob horse big .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\SysWOW64\config\systemprofile\sperm beast hidden swallow (Janette).mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\System32\DriverStore\Temp\cumshot horse [bangbus] hotel .zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\SysWOW64\IME\SHARED\fucking several models .zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\lingerie horse sleeping .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe -
Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\gang bang lingerie [milf] titts .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\malaysia lesbian fetish licking hole .avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files (x86)\Google\Update\Download\blowjob [bangbus] .avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files (x86)\Microsoft\Temp\EU5927.tmp\french beastiality horse [free] black hairunshaved .avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\italian cumshot lesbian ejaculation .zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\horse several models sm .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\nude trambling catfight (Sandy).mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files\Common Files\microsoft shared\american beast several models glans mature (Sylvia).mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\animal [bangbus] nipples bondage .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\brasilian beastiality public ejaculation (Karin,Kathrin).rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\russian cum girls girly .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\beast cum uncut (Britney,Kathrin).avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files (x86)\Microsoft\Temp\handjob action girls latex .rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\porn public Ôï .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files\dotnet\shared\gay licking 50+ .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files\Microsoft Office\Updates\Download\french lingerie sperm [free] 40+ (Karin).avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\asian nude lesbian voyeur girly (Sandy).rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files\Microsoft Office\root\Templates\lingerie cum public shower .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Program Files (x86)\Google\Temp\indian blowjob beastiality big feet penetration .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_c049dbdb4e15bdd2\horse beastiality girls high heels .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\nude hot (!) boobs hairy (Samantha,Tatjana).rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\chinese blowjob hot (!) (Samantha).rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\cumshot porn [milf] (Christine).avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\sperm handjob sleeping .rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\fetish nude [free] .zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\african hardcore [bangbus] 40+ (Britney,Tatjana).mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\danish blowjob hot (!) cock .avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\bukkake gang bang uncut .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\sperm horse several models .avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\brasilian trambling full movie nipples .avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\black handjob lesbian .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\action [milf] 50+ .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\german beast hidden (Tatjana).rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\chinese lesbian xxx catfight cock (Kathrin,Gina).zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\swedish beast trambling full movie redhair .rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\porn catfight titts .zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\fetish licking penetration .zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_4ab14109a3e1e067\tyrkish horse voyeur vagina boots (Sylvia,Liz).zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\canadian fetish [bangbus] .zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\kicking [free] (Sylvia,Melissa).mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\CbsTemp\german trambling [bangbus] nipples .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\black kicking hidden .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\horse [bangbus] traffic .zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\animal lesbian feet hairy .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\brasilian handjob gang bang girls .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\lingerie gay hidden .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\gang bang gang bang girls shower .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\porn uncut bedroom .avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\cum fetish full movie boobs stockings (Melissa,Christine).avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\porn full movie .avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\african fetish catfight .zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\african nude xxx public .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\tyrkish hardcore action girls titts .zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\fetish trambling hot (!) .rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\black gay voyeur shoes (Sarah).avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\german blowjob kicking hidden hole penetration (Sonja,Britney).rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\InstallTemp\fucking handjob public .zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.1_none_813610a8a9b59e0a\swedish gang bang gang bang masturbation lady (Sonja).zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\british gay kicking [free] .avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataoraclec.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_3b8d4dacc2ea6b71\tyrkish nude voyeur vagina black hairunshaved (Karin,Janette).rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\african action masturbation glans penetration .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\cum blowjob lesbian sm (Sarah,Sylvia).rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\action [milf] cock .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\italian blowjob big legs (Kathrin,Liz).mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\bukkake hot (!) hole hairy .zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\canadian lingerie beast sleeping legs traffic .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\swedish beast lesbian [bangbus] wifey .zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\gang bang sperm several models .rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\tyrkish bukkake public .rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\blowjob big .rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\cumshot bukkake licking feet 40+ .avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\nude cum lesbian cock bedroom .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\porn sperm masturbation hole black hairunshaved (Gina).avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\kicking lingerie voyeur ash .avi.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\german bukkake big .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\chinese gay gay hidden traffic .rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\sperm horse hidden .mpg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\cumshot public .rar.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\german nude blowjob [bangbus] beautyfull (Sandy).zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\assembly\tmp\xxx big nipples .zip.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\sperm sleeping .mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\kicking horse big (Tatjana).mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\american cumshot horse big (Curtney).mpeg.exe 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 1248 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 1248 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 1248 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 1248 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 1248 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 1248 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 1248 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 1248 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 1248 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 1248 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 1248 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 1248 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 1248 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 1248 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 2000 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4104 wrote to memory of 932 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 88 PID 4104 wrote to memory of 932 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 88 PID 4104 wrote to memory of 932 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 88 PID 4104 wrote to memory of 2000 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 89 PID 4104 wrote to memory of 2000 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 89 PID 4104 wrote to memory of 2000 4104 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 89 PID 932 wrote to memory of 1248 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 90 PID 932 wrote to memory of 1248 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 90 PID 932 wrote to memory of 1248 932 04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe"C:\Users\Admin\AppData\Local\Temp\04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe"C:\Users\Admin\AppData\Local\Temp\04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe"C:\Users\Admin\AppData\Local\Temp\04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1248
-
-
-
C:\Users\Admin\AppData\Local\Temp\04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe"C:\Users\Admin\AppData\Local\Temp\04686cb8e9efa4dd4f138f8192558b275b29cfe5b9e8f82edf5681b57a669963.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\animal [bangbus] nipples bondage .mpeg.exe
Filesize1.4MB
MD521f997dced0529521258491109ca30c5
SHA1e14e8dcea507926392d4e39ccd78d93accf8dcac
SHA256a8a610d7c1bc216f714acc4d41591b9119f989852a5424b63a04d3c170d2cde4
SHA512b1d386d72aec3dba40d208bd8f4d3abe79473253d1ec4ba87ab6db9bce28003c1bf408ff911f48589c2c44f91b7be73d887cc87e21ac40bc724b2c5c56fdf678