Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
07/04/2024, 20:02
Behavioral task
behavioral1
Sample
35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe
Resource
win7-20240215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe
- Size 251KB
- Sample240407-yr6ltada9s
- SHA256 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4
- MD5 58379969ac6a06d9572f01e761416cbd
- SHA1 7b08d45b48d3a5ea717b1ef7a95577a8bfde418a
- SHA512 465ca268632e3e94717c27f7b0f3ad4f376a039cee94d413ba8aa87fd3802def19a1ad44094ed36a2ff3866bb2e12f44b342a4a75d527db590ba0855e8990ea4
- SSDEEP 6144:tjluQoSDIo5R4nM/40yJNcinBAnGreE3gwxfEp33zPt6hE9E/0Ims:tEQoS9qhFeG6E323zY2mcIms
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Detects executables containing possible sandbox analysis VM usernames 17 IoCs
resource yara_rule behavioral2/memory/1604-151-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-183-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2368-184-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-187-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-189-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-193-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-202-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-205-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-209-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-212-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-215-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-218-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-221-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-224-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-227-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-230-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/100-233-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames - UPX dump on OEP (original entry point) 19 IoCs
resource yara_rule behavioral2/memory/100-0-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/files/0x0007000000023215-5.dat UPX behavioral2/memory/1604-151-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-183-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/2368-184-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-187-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-189-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-193-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-202-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-205-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-209-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-212-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-215-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-218-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-221-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-224-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-227-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-230-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/100-233-0x0000000000400000-0x000000000041D000-memory.dmp UPX - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/100-0-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/files/0x0007000000023215-5.dat upx behavioral2/memory/1604-151-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-183-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2368-184-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-187-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-189-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-193-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-202-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-205-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-209-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-212-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-215-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-218-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-221-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-224-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-227-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-230-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/100-233-0x0000000000400000-0x000000000041D000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\M: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\O: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\R: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\T: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\V: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\G: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\H: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\L: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\N: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\P: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\X: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\Z: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\E: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\Q: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\W: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\U: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\Y: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\A: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\B: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\I: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\J: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File opened (read-only) \??\S: 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\american fucking uncut girly .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\SysWOW64\IME\SHARED\spanish bukkake sleeping lady (Jade).mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\japanese beastiality girls boots .rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\SysWOW64\config\systemprofile\cum handjob several models traffic .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\SysWOW64\IME\SHARED\chinese sperm lingerie girls swallow .mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\System32\DriverStore\Temp\french kicking voyeur vagina .mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\SysWOW64\FxsTmp\french fetish beastiality licking legs shoes .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\spanish sperm gay hidden .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\canadian fetish licking cock YEâPSè& .zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\SysWOW64\FxsTmp\sperm [free] mistress .mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\malaysia bukkake lesbian nipples .zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\brasilian trambling masturbation .rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe - Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\xxx voyeur cock circumcision .rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\japanese fucking gay hot (!) femdom .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\tyrkish fetish beastiality lesbian ,Ó (Kathrin,Jenna).zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\british lingerie [milf] .rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files\dotnet\shared\indian hardcore several models .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files (x86)\Google\Temp\swedish sperm xxx public penetration .rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files\Microsoft Office\root\Templates\african bukkake [milf] boobs ash (Anniston,Ashley).avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\blowjob blowjob voyeur .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\american handjob xxx public (Kathrin,Gina).mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files (x86)\Google\Update\Download\chinese beast hidden feet (Sonja,Anniston).mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\porn porn [free] sm .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files\Common Files\microsoft shared\french blowjob [free] ash .mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\swedish bukkake girls young .zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\tyrkish horse sperm hidden .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files\Microsoft Office\Updates\Download\handjob catfight hotel .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\italian animal several models nipples pregnant (Liz).avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files (x86)\Microsoft\Temp\fucking animal catfight nipples .mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\action hot (!) .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\NetworkService\Downloads\nude public feet bedroom (Tatjana,Karin).mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\lesbian hidden bedroom (Gina,Kathrin).rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\spanish porn hot (!) .mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\swedish lingerie full movie hole wifey (Jade,Sylvia).mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\brasilian handjob licking .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\brasilian porn kicking sleeping .rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\asian sperm gay girls lady .zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\malaysia lingerie hardcore lesbian gorgeoushorny .zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\lingerie beastiality several models .mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\action cumshot girls .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\indian horse masturbation feet bondage (Melissa,Sonja).rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\asian porn cum big penetration (Liz,Britney).rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\cumshot lesbian licking titts blondie .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_72a319bf8ee74a9b\kicking beastiality sleeping hole bondage .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\swedish gang bang licking .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\swedish handjob [milf] (Jenna,Curtney).mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\chinese kicking bukkake licking femdom .mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\lesbian fucking full movie hairy .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\cum lesbian hole gorgeoushorny .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\beastiality [bangbus] .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\gay xxx hidden .zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\swedish beast masturbation wifey (Ashley).rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\japanese gang bang xxx several models titts traffic .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\fetish fucking [milf] feet .mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\action [milf] granny (Melissa,Samantha).zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\lingerie nude big .zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\russian handjob horse licking (Ashley).zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\spanish fucking sleeping nipples traffic .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\tyrkish blowjob licking ash 50+ .mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\norwegian bukkake sperm [free] Ôï .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\black hardcore masturbation vagina .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\african handjob gang bang lesbian gorgeoushorny .rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\danish cum licking .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\Temp\sperm beastiality [milf] penetration (Anniston,Kathrin).rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\nude cum girls YEâPSè& .zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\german nude trambling masturbation high heels .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\animal masturbation blondie (Jenna).mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\british sperm beast sleeping (Gina,Kathrin).rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\german horse gang bang uncut hole high heels (Jenna,Anniston).mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\blowjob masturbation boobs young .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\norwegian bukkake beast voyeur latex .mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\gay fucking hidden hole (Sonja).mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\brasilian cum fetish hot (!) .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\beastiality bukkake uncut penetration (Sandy,Samantha).rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\brasilian blowjob public glans .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\trambling girls (Janette,Curtney).mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\american porn nude uncut high heels (Sarah).mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\french kicking nude uncut YEâPSè& .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\fetish fetish big feet .mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\beast cumshot hot (!) girly .zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\hardcore sleeping .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\kicking hidden ash .mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\russian beastiality trambling hidden glans balls (Sonja).mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\PLA\Templates\tyrkish beast beast full movie titts .mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\chinese gay lingerie hot (!) black hairunshaved .rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\russian sperm beastiality [free] boobs .rar.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\horse hot (!) (Jade,Curtney).zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\danish kicking handjob [milf] .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\nude voyeur blondie .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\cumshot gay hot (!) high heels .zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\gang bang porn [bangbus] .avi.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\animal beast [bangbus] .zip.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\tyrkish hardcore gang bang voyeur balls (Samantha,Ashley).mpeg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\indian trambling girls .mpg.exe 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 1604 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 100 wrote to memory of 2368 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 87 PID 100 wrote to memory of 2368 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 87 PID 100 wrote to memory of 2368 100 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 87 PID 2368 wrote to memory of 1604 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 92 PID 2368 wrote to memory of 1604 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 92 PID 2368 wrote to memory of 1604 2368 35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe"C:\Users\Admin\AppData\Local\Temp\35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Users\Admin\AppData\Local\Temp\35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe"C:\Users\Admin\AppData\Local\Temp\35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe"C:\Users\Admin\AppData\Local\Temp\35eb35c4822773fa317363cd871ef43512096361694ab8b676c3285757facee4.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\swedish bukkake girls young .zip.exe
- Size 854KB
- SHA256 e67a006f0d56e7fb65c84d249d78cd75bb8692e5dd4f04697e42cac4f12bc1d3
- MD5 fd492c44177b112b030f84fee4b0f1d1
- SHA1 806126f10c7ee4a7e3c86f755d68d0b650ceac03
- SHA512 874b46504bf581aad958a435b95ca9ae70f9affdef723c5622a0143e531ea5ebd6cf9eac7c411a68e3ebe0252a79da93efd7075bfef368020056784c08f1613f
- SSDEEP 12288:tEQoS9qhIdYRhztm2aJl4zX0eSPC5VkCXf8iEojxt+SeK/TGGkxvF5F60mjyUfOo:t2IdYbkl4geSq5Ge9jxt+STbGRa00Bv
- MD5 SHA1 SHA512 SSDEEP