Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 21:00
Behavioral task
behavioral1
Sample
5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe
Resource
win10v2004-20240226-en
General
-
Target
5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe
-
Size
2.0MB
-
MD5
6f2d8103a3802ac02c2b425b195ecec3
-
SHA1
7fcbece54a22e7d1f9d5b284d6d7901ad2161ab7
-
SHA256
5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f
-
SHA512
e67d4142e625751fc296bdaec1231bdbb50ce8807452092538dd1406c116cba73643f412c20dbbfb11944ba18ab1892c7a02c98264a1d8f433253240018e0af7
-
SSDEEP
49152:juJWNuGO2kpSOYL43mFnNaKfZSHXH3w97M67v00NMqbzgBNfdV+Pz:jtuGEV3mtH43H3wdM+vlNMYgLd4Pz
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 2 IoCs
Processes:
resource yara_rule behavioral2/memory/5016-68-0x0000000000400000-0x0000000000429000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2104-167-0x0000000000400000-0x0000000000429000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1612-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\fetish fucking uncut .rar.exe UPX behavioral2/memory/5016-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3496-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2104-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1612-0-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\fetish fucking uncut .rar.exe upx behavioral2/memory/5016-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-167-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exedescription ioc process File opened (read-only) \??\Z: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\B: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\E: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\K: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\R: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\V: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\W: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\Y: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\A: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\G: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\J: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\M: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\P: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\H: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\L: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\N: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\S: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\X: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\I: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\O: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\Q: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\T: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File opened (read-only) \??\U: 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe -
Drops file in System32 directory 12 IoCs
Processes:
5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\gay [free] .avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\SysWOW64\FxsTmp\gay full movie (Sarah,Melissa).zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\SysWOW64\IME\SHARED\handjob lesbian masturbation legs (Kathrin).avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\sperm uncut leather (Anniston).mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\SysWOW64\config\systemprofile\norwegian beast hot (!) .avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\tyrkish kicking public vagina girly (Janette,Sonja).zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\System32\DriverStore\Temp\beast porn lesbian titts 40+ (Jenna).rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\sperm hot (!) sweet .avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\porn bukkake public shower .mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\SysWOW64\FxsTmp\chinese action lesbian ash .mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\SysWOW64\IME\SHARED\lesbian animal uncut titts (Christine).avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\blowjob handjob big legs balls .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe -
Drops file in Program Files directory 18 IoCs
Processes:
5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\xxx handjob lesbian shoes (Sylvia,Kathrin).zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files (x86)\Google\Temp\german lesbian public titts balls .mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files (x86)\Google\Update\Download\black blowjob gay sleeping boots (Janette).rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files\dotnet\shared\norwegian trambling fetish hidden bedroom .mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\fetish fucking uncut .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\norwegian porn big black hairunshaved .mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files\Microsoft Office\Updates\Download\hardcore [milf] hotel .avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\african bukkake handjob catfight shoes .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files\Microsoft Office\root\Templates\blowjob bukkake voyeur bondage .avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\black action trambling [milf] .mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\danish beastiality masturbation bedroom .zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\british kicking sperm [bangbus] glans (Curtney).mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\porn horse licking ΋ .zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\danish gang bang hidden .zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\canadian hardcore sperm lesbian .mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\action big black hairunshaved .mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\xxx fucking girls .avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Program Files (x86)\Microsoft\Temp\kicking big .mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe -
Drops file in Windows directory 64 IoCs
Processes:
5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\malaysia cum cumshot public (Melissa).zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\spanish horse sperm hot (!) ash (Christine).avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\asian blowjob hidden feet .mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\fucking porn hot (!) ash .mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\gay lingerie full movie .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_c9ce604ef4cbf323\malaysia bukkake trambling public vagina .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\italian fucking fucking [milf] titts bedroom (Liz,Sarah).mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\danish beast lesbian girls .avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\malaysia kicking licking .mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\norwegian horse [milf] titts .mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\chinese porn sperm hot (!) penetration .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\InputMethod\SHARED\tyrkish blowjob uncut sm .mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\indian fetish lingerie catfight vagina .zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_72a319bf8ee74a9b\bukkake [bangbus] .avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\tyrkish nude gang bang masturbation high heels (Sonja).rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\PLA\Templates\blowjob full movie vagina 40+ .zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\indian sperm cum [milf] upskirt .mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\action catfight mistress (Samantha).mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\norwegian nude handjob masturbation .zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\CbsTemp\gang bang lesbian [bangbus] penetration .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\russian fetish voyeur ash high heels .mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\horse lesbian leather (Sylvia,Britney).zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\french fetish porn [bangbus] traffic .mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\horse lesbian sweet .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\cumshot big .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\porn gang bang [bangbus] redhair .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\swedish bukkake cum uncut mature .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\swedish handjob blowjob [bangbus] sweet .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\sperm voyeur nipples (Anniston,Sonja).rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\russian handjob beast [free] penetration .zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\fetish animal catfight hotel (Liz).mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\cumshot [milf] ash boots .mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\american hardcore xxx big mistress (Tatjana,Tatjana).zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\russian cum catfight 40+ .mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\beastiality horse several models (Anniston,Tatjana).zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\lesbian public (Sylvia,Sonja).mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\gay masturbation .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\american lingerie gang bang [milf] feet (Christine,Anniston).avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\british bukkake lesbian .avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\norwegian horse [free] ash mistress .mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\brasilian blowjob uncut .zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\nude horse hot (!) girly .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\russian kicking fucking sleeping granny .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\sperm masturbation ash redhair .zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\beast [milf] traffic (Ashley).zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\horse uncut .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\porn animal voyeur gorgeoushorny (Jenna,Samantha).mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\gay gay girls penetration (Britney,Sandy).zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.746_none_4cfe603abbcbfd86\canadian hardcore fetish public .avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\asian beast hot (!) sweet (Sylvia).mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\spanish horse kicking masturbation (Ashley,Kathrin).mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\british sperm voyeur mature (Sylvia,Tatjana).mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\swedish kicking porn girls mistress .zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\british cum sleeping titts .mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\Downloaded Program Files\animal hot (!) hole .zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\african lesbian gang bang sleeping .avi.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\asian gay public beautyfull .mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\malaysia hardcore lingerie girls mistress .mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\lingerie voyeur vagina balls (Samantha,Anniston).rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\asian lingerie horse hot (!) (Sonja,Sandy).mpg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\animal [bangbus] ash lady (Sonja,Sonja).mpeg.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\chinese xxx [free] feet .zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\gay kicking public (Melissa).zip.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\spanish beastiality horse hidden vagina young .rar.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exepid process 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 2104 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 2104 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 2104 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 2104 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 2104 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 2104 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 2104 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 2104 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 2104 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 2104 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 2104 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 2104 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 2104 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 2104 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 3496 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exedescription pid process target process PID 1612 wrote to memory of 5016 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe PID 1612 wrote to memory of 5016 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe PID 1612 wrote to memory of 5016 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe PID 1612 wrote to memory of 3496 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe PID 1612 wrote to memory of 3496 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe PID 1612 wrote to memory of 3496 1612 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe PID 5016 wrote to memory of 2104 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe PID 5016 wrote to memory of 2104 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe PID 5016 wrote to memory of 2104 5016 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe 5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe"C:\Users\Admin\AppData\Local\Temp\5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe"C:\Users\Admin\AppData\Local\Temp\5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe"C:\Users\Admin\AppData\Local\Temp\5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe"C:\Users\Admin\AppData\Local\Temp\5033d1df1c982605614f3b8389af39a9c541444a192af4eaa37413f9d1b6042f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\fetish fucking uncut .rar.exe
Filesize1.5MB
MD5433a0376a024fdf8b35256c0f9164414
SHA1d1d45f79ab09cdb434087498c211e84383313464
SHA25620a5d73b695d189c9dcd55a2ddcc313e4f072fd060d8f8f6c953034ab326263e
SHA512966d60a3597c2b3d1ef4a5ecebda8a2ab1fe9b29c37d5d9c81266c4d17bf98d7629dac37c9e2db2529d85e6c8f111659b7883aab13db053829d745cfb5d24bc7