Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 20:13
Behavioral task
behavioral1
Sample
3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe
Resource
win10v2004-20240226-en
General
-
Target
3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe
-
Size
1.4MB
-
MD5
174daa247aefc52d66f535735e1f3426
-
SHA1
09f4b3f3fb972a89dc66af59ef84f4e3584c6e00
-
SHA256
3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc
-
SHA512
b9ad7ba6f0eb0a4f4bf2fe693dcf26bf75e4ab78f386d0e51931d57b946e4c916273772c0882b6398359275564c1964d79ef09d4dab2b4f67bbda7d51830136f
-
SSDEEP
24576:bHXsaqaoi0NP91nBvdVhe3lehBaaSwOwgi4EiDeo8y+MfmcxP+:j8anCP9lBbhee7owtiqo8QmKP+
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3088-21-0x0000000000400000-0x0000000000429000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2844-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\gay girls stockings .mpg.exe UPX behavioral2/memory/3088-21-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3932-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2844-0-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\gay girls stockings .mpg.exe upx behavioral2/memory/3088-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-151-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exedescription ioc process File opened (read-only) \??\P: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\Q: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\A: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\B: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\E: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\T: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\X: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\Z: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\G: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\M: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\N: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\S: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\V: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\H: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\J: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\O: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\R: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\U: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\W: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\Y: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\I: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\K: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File opened (read-only) \??\L: 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe -
Drops file in System32 directory 12 IoCs
Processes:
3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exedescription ioc process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\japanese action trambling [bangbus] fishy (Kathrin,Sarah).mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\blowjob full movie feet .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\SysWOW64\FxsTmp\russian handjob gay lesbian .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\SysWOW64\IME\SHARED\hardcore licking (Curtney).zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\blowjob sleeping hotel .avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\SysWOW64\config\systemprofile\swedish porn lingerie [bangbus] (Janette).rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\SysWOW64\IME\SHARED\brasilian cum hardcore voyeur feet .mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\SysWOW64\config\systemprofile\japanese nude gay catfight ash .mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\System32\DriverStore\Temp\indian fetish hardcore several models cock .mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\black animal lingerie [bangbus] stockings .mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\black gang bang beast uncut .mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\SysWOW64\FxsTmp\tyrkish beastiality trambling voyeur hairy .mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe -
Drops file in Program Files directory 19 IoCs
Processes:
3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exedescription ioc process File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\brasilian kicking fucking [milf] cock .avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files (x86)\Google\Update\Download\japanese action trambling voyeur girly .rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files (x86)\Microsoft\Temp\hardcore girls leather .zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\trambling big ash (Jenna,Sarah).zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\black gang bang fucking lesbian YEâPSè& .zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\gay girls stockings .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\danish action xxx several models cock mistress .rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\danish cum trambling lesbian girly .mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files\Common Files\microsoft shared\blowjob uncut cock 40+ .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files\Microsoft Office\root\Templates\russian horse trambling girls traffic (Sandy,Liz).avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\brasilian animal horse lesbian .mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files (x86)\Microsoft\Temp\EU8B19.tmp\indian kicking sperm big .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\swedish handjob bukkake [bangbus] .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files (x86)\Google\Temp\hardcore hot (!) cock swallow (Jade).mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\indian nude hardcore [bangbus] circumcision .rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files\dotnet\shared\italian gang bang horse voyeur stockings .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files\Microsoft Office\Updates\Download\xxx full movie feet .rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\trambling lesbian young .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\japanese gang bang lingerie several models beautyfull .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe -
Drops file in Windows directory 64 IoCs
Processes:
3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\handjob lingerie hot (!) (Melissa).avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\brasilian gang bang lingerie several models feet .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\chinese fucking hidden mistress (Gina,Janette).avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\american animal blowjob girls cock hairy .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\tyrkish kicking horse uncut glans (Gina,Sarah).mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\xxx licking sweet .zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\british lingerie [bangbus] penetration .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\gay licking pregnant .mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\swedish cum fucking big .rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\african trambling voyeur glans .rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\animal hardcore [milf] titts latex .mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\PLA\Templates\tyrkish fetish beast [free] (Karin).mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_4ab14109a3e1e067\german lingerie big glans swallow .zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\asian horse uncut castration .avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\gay masturbation .zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\brasilian handjob blowjob full movie swallow (Christine,Curtney).zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\italian cumshot horse sleeping circumcision .avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\action xxx [free] upskirt (Jenna,Jade).mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\japanese porn fucking [bangbus] cock leather .mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\assembly\tmp\swedish animal xxx several models high heels .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\american gang bang beast catfight titts sweet (Samantha).mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\russian handjob beast big (Liz).rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\french hardcore uncut hole .zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\beast full movie glans black hairunshaved .zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\malaysia fucking catfight (Melissa).zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\indian porn hardcore full movie gorgeoushorny .avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\malaysia gay lesbian shower .mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_b201c2e68d8dbc0d\italian animal lesbian [free] .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\mssrv.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\german horse public titts young .rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\brasilian kicking beast [free] balls .zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\cum lingerie full movie penetration .avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\asian blowjob [free] girly .avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\horse fucking uncut hole black hairunshaved (Curtney).zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\asian trambling several models shoes (Sandy,Karin).rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\cumshot trambling hot (!) cock black hairunshaved .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\gang bang horse several models mistress .rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\canadian lesbian catfight (Sarah).rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\chinese gay lesbian titts .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\nude sperm girls titts castration (Jade).mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\horse licking upskirt .zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\french xxx hidden blondie .zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\cum gay [bangbus] (Curtney).mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\fetish beast uncut (Jade).zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\african horse several models cock .avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\trambling several models sweet .zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\russian beastiality blowjob [milf] .rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\security\templates\japanese porn blowjob [free] YEâPSè& .avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\canadian beast uncut titts boots .zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\beast full movie (Tatjana).avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\brasilian handjob gay sleeping glans .avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\black action bukkake [free] feet penetration .avi.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\african gay sleeping fishy .mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\malaysia fucking hidden ash .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.1_none_5a23b464e1e0b15e\chinese lingerie catfight hairy .zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\beastiality blowjob full movie cock bondage (Samantha).rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\norwegian horse hot (!) titts .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\Downloaded Program Files\bukkake hidden cock (Britney,Tatjana).mpeg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\horse lesbian uncut titts .zip.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\sperm licking .rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\canadian blowjob public .rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_c049dbdb4e15bdd2\chinese sperm [free] YEâPSè& .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\action fucking big beautyfull .rar.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\handjob trambling girls stockings .mpg.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exepid process 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3932 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exedescription pid process target process PID 2844 wrote to memory of 3088 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe PID 2844 wrote to memory of 3088 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe PID 2844 wrote to memory of 3088 2844 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe PID 3088 wrote to memory of 3932 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe PID 3088 wrote to memory of 3932 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe PID 3088 wrote to memory of 3932 3088 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe 3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe"C:\Users\Admin\AppData\Local\Temp\3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe"C:\Users\Admin\AppData\Local\Temp\3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe"C:\Users\Admin\AppData\Local\Temp\3b327da35f60060150653b401ecb0cead43c1845daa0597939f060979bee83cc.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\gay girls stockings .mpg.exe
Filesize1.5MB
MD518bdf1806ce04e968c32e6f2a3deb01c
SHA10f6dc97b3cd24107257964c4dfa856b9d86aed5c
SHA256e846f8b8b4031f45dd2479779f80e3b0ed0a0c62ea5cdb5677aafa9b05422c6a
SHA512195f22d1a506e7aca12fd764d63aa6da4c6e36ae94bef2a539165fb4fcdbe58a4071fdbeb35cf4911fccad29541b1027933f363ee31fa34bce202c7bebb49283