Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 19:57
Behavioral task
behavioral1
Sample
33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe
Resource
win10v2004-20240226-en
General
-
Target
33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe
-
Size
234KB
-
MD5
1f5362f579d01f0f0c0e62628bfc79e6
-
SHA1
cdc1c18d3446f1445436a93c758c1bd72d4c5d52
-
SHA256
33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4
-
SHA512
55693b31b2078c288bb827312fbb1fc00d29fe2cfa108245ba0b485aa4e7a9b24129e8afa7a5b67c5c107d17bef58bbebad98cc70ab120212bfcbf65e4a23692
-
SSDEEP
6144:NPDLCL+Io5R4nM/4rgwNkMWWQUy8ZwYjA7Y1ntXdmQg:NPKLyqzgwN33y8ZwYnt8t
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
Processes:
resource yara_rule C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\brasilian lesbian fucking masturbation .mpg.exe UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/3480-0-0x0000000000400000-0x000000000041E000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\brasilian lesbian fucking masturbation .mpg.exe upx behavioral2/memory/4376-57-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2984-157-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3156-158-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3480-188-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4376-193-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2984-194-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3156-195-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exedescription ioc process File opened (read-only) \??\G: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\I: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\L: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\O: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\V: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\X: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\Y: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\B: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\E: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\P: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\R: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\T: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\U: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\A: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\M: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\H: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\K: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\N: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\Q: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\S: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\W: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\Z: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File opened (read-only) \??\J: 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe -
Drops file in System32 directory 12 IoCs
Processes:
33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\beast hardcore catfight .avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\SysWOW64\FxsTmp\cumshot [free] ash .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\lesbian lesbian [milf] hairy (Sarah,Sandy).mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\SysWOW64\IME\SHARED\beast handjob voyeur (Ashley).rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\System32\DriverStore\Temp\fucking big mistress (Ashley,Samantha).mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\SysWOW64\IME\SHARED\fetish licking vagina traffic (Jenna,Melissa).rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\trambling cumshot sleeping .zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\tyrkish porn fetish catfight sm .zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\SysWOW64\config\systemprofile\black xxx masturbation sm (Tatjana,Gina).mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\SysWOW64\FxsTmp\cumshot beast hot (!) glans Ôï .rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\horse full movie .mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\african fucking several models titts .mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe -
Drops file in Program Files directory 18 IoCs
Processes:
33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exedescription ioc process File created C:\Program Files\Windows Sidebar\Shared Gadgets\beastiality lesbian nipples granny .avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\german xxx beastiality [milf] boots .avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\horse public fishy (Sarah,Christine).avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files\dotnet\shared\norwegian fetish lesbian .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files\Microsoft Office\root\Templates\brasilian sperm gay girls .zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\black action cumshot full movie legs fishy .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files\Microsoft Office\Updates\Download\xxx cumshot several models beautyfull .rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\tyrkish xxx public wifey .avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\brasilian lesbian fucking masturbation .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\french xxx catfight glans .rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files (x86)\Google\Temp\fucking xxx big sweet .mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files (x86)\Google\Update\Download\brasilian blowjob cumshot licking upskirt .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files (x86)\Microsoft\Temp\british fucking big swallow .rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\asian nude full movie mature .zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files\Common Files\microsoft shared\lesbian lesbian licking (Kathrin).mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\norwegian beast blowjob hot (!) (Ashley).avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\italian lingerie hardcore uncut black hairunshaved .avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\gang bang horse [free] titts ash .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe -
Drops file in Windows directory 64 IoCs
Processes:
33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exedescription ioc process File created C:\Windows\Downloaded Program Files\norwegian animal gay sleeping penetration .zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\beast porn several models glans stockings .avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\xxx animal lesbian wifey .zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\canadian sperm hot (!) ejaculation (Sarah,Anniston).mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\american horse masturbation hole black hairunshaved (Anniston).avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\canadian trambling [milf] (Britney).zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\british blowjob kicking masturbation traffic (Janette,Melissa).mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\swedish porn horse [bangbus] blondie .mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\cum xxx public sm .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\african kicking uncut titts (Sandy).avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\brasilian gang bang [free] ejaculation .zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\french kicking [milf] .rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\french beastiality beast catfight ejaculation .mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\chinese xxx lesbian boobs young (Jenna,Kathrin).mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\indian hardcore masturbation .zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\gang bang hidden circumcision .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\hardcore masturbation mistress (Karin,Janette).mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\porn [free] hairy .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\asian lesbian animal [bangbus] high heels .mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\xxx voyeur .mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\danish xxx cum catfight cock upskirt .rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\indian kicking kicking girls (Janette,Liz).zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\african cum hardcore several models (Curtney,Sonja).rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.1_none_5a23b464e1e0b15e\brasilian handjob uncut circumcision (Anniston).rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\beast uncut ash .avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\action lesbian (Gina,Sonja).avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\danish porn [bangbus] .zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\canadian beast fetish lesbian boobs (Sonja).mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\japanese fetish licking young .mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\fetish horse [free] traffic .zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\beast uncut leather .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\brasilian kicking girls (Sylvia,Sonja).mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\nude horse lesbian .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\bukkake lesbian [free] hairy (Anniston,Britney).rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\black bukkake catfight .zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\asian horse licking (Gina).rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\kicking big (Sarah).mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\german blowjob nude full movie black hairunshaved .avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\norwegian fucking kicking [bangbus] (Sonja).zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\indian blowjob hidden glans pregnant .rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\horse action masturbation wifey .mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\brasilian fucking nude uncut .zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\japanese sperm [free] .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\action xxx big .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\nude big .avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\spanish animal masturbation feet circumcision (Britney).avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\brasilian handjob sleeping high heels .avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\kicking xxx masturbation cock upskirt .mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\lingerie hardcore several models redhair (Sandy).rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\spanish trambling masturbation cock .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\black cum sleeping feet (Sonja).zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\malaysia trambling animal [bangbus] ejaculation .mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\norwegian gang bang lingerie big ash .zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\porn catfight .zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\american blowjob lesbian penetration .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.1_none_813610a8a9b59e0a\sperm fetish girls hotel .avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\action nude lesbian hole .mpg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataoraclec.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_3b8d4dacc2ea6b71\gang bang animal licking stockings (Samantha,Sonja).mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\spanish sperm gang bang public .mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\cum [free] (Janette).rar.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\hardcore hardcore hidden ejaculation (Sonja,Sonja).zip.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\spanish porn gay uncut sm (Ashley).mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\chinese hardcore cum hidden blondie (Sarah).mpeg.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\swedish action beast [bangbus] mistress .avi.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exepid process 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 3156 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 2984 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exedescription pid process target process PID 3480 wrote to memory of 4376 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe PID 3480 wrote to memory of 4376 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe PID 3480 wrote to memory of 4376 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe PID 3480 wrote to memory of 2984 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe PID 3480 wrote to memory of 2984 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe PID 3480 wrote to memory of 2984 3480 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe PID 4376 wrote to memory of 3156 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe PID 4376 wrote to memory of 3156 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe PID 4376 wrote to memory of 3156 4376 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe 33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe"C:\Users\Admin\AppData\Local\Temp\33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe"C:\Users\Admin\AppData\Local\Temp\33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe"C:\Users\Admin\AppData\Local\Temp\33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe"C:\Users\Admin\AppData\Local\Temp\33cfb7c9c00d219166b7c1688d5711667fa618960132723813876fc2293ca6d4.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\brasilian lesbian fucking masturbation .mpg.exe
Filesize523KB
MD5a8ab3a9270f56c5d28502be8b3c31332
SHA197fcfa3d209a93a4e9091522c4b7ebfcc29c77d7
SHA2566bfc2428501711875acbd887b986d3ce22d9c6eaf89228f947408b26a4920f23
SHA51242255e76a39e42e5c9c54e9cf7031f8cbba543eb44a4728ddd0430ae7bc3d45bcbc589227eddde06d3dc36f5d8d788d2bcc02099d7f600a4e0a7f4625ac7e5c1
-
Filesize
146B
MD56ae2bef8f6aa6ba58dc44aaa60df5a0f
SHA12719a5ac786fa0e27580ce7e192cdfc9ed10102a
SHA2569a4127086ea21f9498466058686dd8795fcc647f6af330dae28d892467e69158
SHA5125521c5baffe2887fe65b18974f2e22673be4452e3e9f00a295a967ff208cb785ef99a7ebf87ac4475ddfa002fa75db5e2090b973f43c528e61644f6a20c6dcf1