Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 23:24
Behavioral task
behavioral1
Sample
9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe
Resource
win10v2004-20240319-en
General
-
Target
9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe
-
Size
266KB
-
MD5
e3e428054fbb0ac813d33336699fc5ec
-
SHA1
9b1642a991117d4c24b16c4b2a927f09f7b5aef9
-
SHA256
9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c
-
SHA512
e8f6539de521f6def10bdde707ee80505863795fc4c59e99f2058bb5a550c4692fcbc2df276508c4c76d0bea0f056e74178e8f56930a290a04f436e8ab655322
-
SSDEEP
6144:sPDLCL9Io5R4nM/40y37Ysxio/w3leWj8ZFfUMzHL1XH+gb:sPKLXq/7vioc0WnMzr1Xegb
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
Processes:
resource yara_rule C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\swedish handjob xxx uncut .mpg.exe UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2952-0-0x0000000000400000-0x000000000041C000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\swedish handjob xxx uncut .mpg.exe upx behavioral2/memory/1336-10-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4568-39-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3140-40-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2952-180-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1336-193-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4568-196-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3140-197-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exedescription ioc process File opened (read-only) \??\M: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\X: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\Y: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\E: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\N: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\Q: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\U: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\W: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\Z: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\B: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\G: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\L: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\O: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\P: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\R: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\A: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\I: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\J: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\K: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\S: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\T: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\V: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File opened (read-only) \??\H: 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe -
Drops file in System32 directory 12 IoCs
Processes:
9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exedescription ioc process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\sperm girls glans beautyfull (Karin).mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\SysWOW64\config\systemprofile\sperm hot (!) lady .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\System32\DriverStore\Temp\american cum blowjob catfight glans stockings .rar.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\SysWOW64\FxsTmp\fetish hardcore licking YEâPSè& .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\russian nude gay full movie (Samantha).rar.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\brasilian cum trambling public .rar.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\SysWOW64\IME\SHARED\brasilian cum fucking [bangbus] feet leather .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\swedish animal blowjob uncut 50+ .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\SysWOW64\IME\SHARED\black nude horse voyeur .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\indian action xxx licking cock .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\SysWOW64\config\systemprofile\bukkake hot (!) (Curtney).rar.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\SysWOW64\FxsTmp\trambling hidden .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe -
Drops file in Program Files directory 19 IoCs
Processes:
9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exedescription ioc process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\spanish lingerie hidden feet .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files\dotnet\shared\hardcore masturbation (Liz).avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\swedish handjob xxx uncut .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\russian animal bukkake voyeur sweet .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\gay sleeping femdom .avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files\Microsoft Office\Updates\Download\german sperm masturbation .rar.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\indian cum blowjob full movie (Samantha).avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\danish handjob bukkake licking hole .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\danish nude gay hot (!) (Jade).mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\indian nude beast girls hole .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\brasilian kicking fucking big .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files (x86)\Google\Temp\brasilian action sperm hot (!) (Jade).mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files (x86)\Google\Update\Download\swedish nude xxx girls (Curtney).mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files\Common Files\microsoft shared\trambling full movie titts girly .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files\Microsoft Office\root\Templates\swedish handjob gay hidden (Liz).avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files (x86)\Microsoft\Temp\gay girls glans circumcision (Karin).rar.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\italian nude beast catfight .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\lingerie big cock YEâPSè& .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{D3EA2F86-0081-495C-8439-1E64CA71F999}\EDGEMITMP_57EE5.tmp\trambling girls cock swallow .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe -
Drops file in Windows directory 64 IoCs
Processes:
9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exedescription ioc process File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\cumshot gay voyeur .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\african lingerie public circumcision .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\cum bukkake hot (!) .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\xxx uncut circumcision .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\black cum lesbian [milf] (Sarah).zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\horse [free] black hairunshaved .avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\horse horse licking .avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\french trambling [milf] (Samantha).zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\horse trambling masturbation titts high heels (Karin).avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\french sperm several models feet hairy .rar.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\cumshot sperm girls hole .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\british lesbian [bangbus] titts lady .avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\italian action sperm [free] (Sylvia).zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_b201c2e68d8dbc0d\asian bukkake licking (Curtney).zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\malaysia lesbian catfight circumcision .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\x86_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_231ddfc33015c6db\malaysia gay catfight .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\porn horse masturbation cock .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\british hardcore uncut feet 40+ .rar.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\danish cumshot bukkake catfight ejaculation .avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\french blowjob girls circumcision .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\trambling [bangbus] .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\beast sleeping (Janette).zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\asian lingerie lesbian feet .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\beast full movie ash .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\danish animal beast licking hole .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\animal sperm lesbian fishy .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\beast public circumcision (Sonja,Karin).mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\chinese horse full movie gorgeoushorny .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\bukkake masturbation titts swallow (Janette).zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\horse public .avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\PLA\Templates\blowjob full movie hole pregnant .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\chinese lingerie big black hairunshaved .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\malaysia hardcore public glans gorgeoushorny .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\italian cumshot gay public titts mistress .rar.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\security\templates\indian action trambling hidden feet latex (Janette).avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\porn blowjob uncut cock YEâPSè& .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\action hardcore [free] (Curtney).mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\french beast [milf] hole .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\handjob xxx [bangbus] shower (Sonja,Curtney).zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\beast several models penetration .avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\beastiality sperm uncut feet .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\animal horse girls .avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\french sperm lesbian .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\horse beast sleeping titts bondage .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\lesbian full movie feet hairy (Sarah).mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\handjob beast licking (Sarah).zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\italian gang bang xxx [free] glans .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\xxx full movie cock .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\russian cum lesbian sleeping young .rar.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\chinese sperm [milf] feet (Sonja,Melissa).zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\InputMethod\SHARED\swedish kicking beast big YEâPSè& .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\indian kicking fucking public hole black hairunshaved .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\malaysia lingerie several models bondage .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\british bukkake masturbation .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\american beastiality lesbian big titts stockings .avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\fucking hidden high heels .avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\handjob lesbian [milf] (Sylvia).zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\american cumshot lesbian hot (!) feet .mpeg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\asian xxx full movie (Jade).avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\swedish animal bukkake several models titts .avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\xxx licking glans .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\chinese trambling lesbian cock shoes .avi.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\chinese blowjob big titts .mpg.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\action lingerie full movie YEâPSè& .zip.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exepid process 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 3140 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 3140 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 3140 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 3140 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 3140 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 3140 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 3140 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 3140 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 3140 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 3140 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 3140 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 3140 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 3140 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 3140 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 4568 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exedescription pid process target process PID 2952 wrote to memory of 1336 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe PID 2952 wrote to memory of 1336 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe PID 2952 wrote to memory of 1336 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe PID 2952 wrote to memory of 4568 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe PID 2952 wrote to memory of 4568 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe PID 2952 wrote to memory of 4568 2952 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe PID 1336 wrote to memory of 3140 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe PID 1336 wrote to memory of 3140 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe PID 1336 wrote to memory of 3140 1336 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe 9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe"C:\Users\Admin\AppData\Local\Temp\9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe"C:\Users\Admin\AppData\Local\Temp\9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe"C:\Users\Admin\AppData\Local\Temp\9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3140
-
-
-
C:\Users\Admin\AppData\Local\Temp\9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe"C:\Users\Admin\AppData\Local\Temp\9137159160a9f84a6983dd05668cfc3100003d55301ad184b1313127b06a2c0c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1012 --field-trial-handle=2228,i,8155065313278028490,17854605419281052753,262144 --variations-seed-version /prefetch:81⤵PID:1632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\swedish handjob xxx uncut .mpg.exe
Filesize129KB
MD5709bf9ce42aeac154ca59ac264a0ec8a
SHA14fd0984de65abf036f71b388c2a1ecd8f3a75bb6
SHA2561c9525a11401103038d90ffafe9a930210d74e0e6ecee0a815e52addd4034023
SHA512f19b3d7e755a3f9cece2aa4feb236735dd4980f5e58b24ddc3d70469c3a768dcedf3bf812146f2f37c8aff1fbf4dd452ad0e1c1f3caa60282fb66e0718528bde