Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-04-2024 01:25
Static task
static1
Behavioral task
behavioral1
Sample
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe
Resource
win10v2004-20240226-en
General
-
Target
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe
-
Size
292KB
-
MD5
a3bc5a1f20e21874d56c71282c3104fe
-
SHA1
90e6f287921d4a59ee7df91dacc191ab1645fff9
-
SHA256
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d
-
SHA512
ed8966e993aa10c42b433b8b1f09ea8087a2a63869adacfb3c27eb365fab43259581abc265279fa6fd0b7c1087867b70d1a36626ec0ff39b5ade35c653b2fecc
-
SSDEEP
6144:dXC4vgmhbIxs3NBR3BHgPZacfQbdErY1iMbnz3Vq8ukh6KQFZE:dXCNi9BHg0VbWGX3VQp2
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
Processes:
resource yara_rule behavioral1/files/0x0007000000015c81-4.dat INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exedescription ioc Process File opened (read-only) \??\V: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\A: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\B: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\E: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\G: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\P: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\U: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\N: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\R: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\S: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\T: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\Z: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\H: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\K: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\O: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\W: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\X: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\Y: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\I: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\J: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\L: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\M: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\Q: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe -
Drops file in System32 directory 10 IoCs
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exedescription ioc Process File created C:\Windows\SysWOW64\config\systemprofile\lingerie full movie .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\tyrkish animal blowjob masturbation boots .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\american gang bang lesbian uncut feet .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\System32\DriverStore\Temp\lingerie [milf] cock 50+ (Janette).mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\FxsTmp\fetish blowjob several models bondage (Sonja,Melissa).rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\IME\shared\italian porn beast sleeping leather .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\blowjob uncut \× .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\FxsTmp\american porn xxx hidden leather .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\IME\shared\tyrkish handjob blowjob masturbation .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\config\systemprofile\hardcore [milf] feet .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe -
Drops file in Program Files directory 15 IoCs
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exedescription ioc Process File created C:\Program Files\Windows Journal\Templates\indian cum blowjob big (Melissa).mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\russian action hardcore hot (!) beautyfull .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\horse girls feet .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\russian beastiality beast catfight titts 50+ .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Common Files\microsoft shared\italian nude lingerie licking .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\american cum hardcore voyeur mistress .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\american cumshot horse public stockings (Christine,Sylvia).zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Microsoft Office\Templates\american porn lesbian [free] mistress .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files\Common Files\Microsoft Shared\beast catfight titts balls .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files\DVD Maker\Shared\american horse bukkake several models (Sylvia).avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Google\Temp\beast [free] titts .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Google\Update\Download\tyrkish beastiality bukkake uncut hole traffic (Liz).zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\trambling hidden glans .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\fucking sleeping titts .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\gay [bangbus] titts .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe -
Drops file in Windows directory 64 IoCs
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exedescription ioc Process File created C:\Windows\Downloaded Program Files\trambling masturbation beautyfull .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\horse several models .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\chinese horse big glans 40+ .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\beastiality lesbian sleeping wifey .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SoftwareDistribution\Download\fucking public ìï .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\sperm uncut glans hairy .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\canadian blowjob big lady .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\hardcore hot (!) .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\brasilian horse trambling girls blondie .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\african gay [free] swallow .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\nude fucking sleeping .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\american action lesbian [free] feet sweet (Curtney).rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\indian nude hardcore hot (!) .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\bukkake public hole .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\german horse hot (!) beautyfull .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\german fucking hidden .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\indian horse trambling licking feet bondage .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\fetish horse hot (!) cock .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\indian porn horse [free] hairy .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\temp\lingerie public glans sweet (Sylvia).rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\italian porn trambling voyeur glans .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\spanish bukkake licking (Melissa).mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\canadian bukkake public lady .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\sperm sleeping (Janette).mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\gang bang lingerie sleeping titts leather (Jade).mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\kicking horse girls upskirt (Jenna,Tatjana).avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\mssrv.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\indian handjob beast full movie cock .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\indian nude sperm several models mature .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\bukkake [bangbus] .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\bukkake [free] penetration (Kathrin,Janette).zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\russian nude sperm sleeping .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\canadian lingerie public cock .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\black horse lingerie sleeping (Sylvia).avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\swedish handjob fucking sleeping hotel .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\lesbian voyeur titts .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\tyrkish cumshot hardcore full movie mature .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\black cumshot bukkake hidden glans gorgeoushorny .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\lingerie lesbian hole .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\fucking hot (!) cock traffic .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\black animal sperm voyeur pregnant .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\security\templates\american action horse hidden hole .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\danish porn blowjob masturbation (Janette).zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\xxx [milf] granny .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\german blowjob uncut boots .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\sperm hot (!) feet fishy .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\beastiality beast catfight sm (Ashley,Karin).avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\porn xxx public (Sylvia).mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\canadian blowjob sleeping sweet (Christine,Melissa).avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\black horse lingerie masturbation .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\french sperm masturbation ejaculation .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\lesbian big stockings .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\danish action lesbian [milf] bedroom .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\french bukkake several models femdom .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\danish animal beast sleeping .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\sperm full movie .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\InstallTemp\spanish fucking big femdom (Britney,Sarah).rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\cumshot horse catfight titts lady .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\russian cumshot trambling lesbian (Samantha).zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\brasilian nude sperm lesbian feet sm .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\british lingerie [bangbus] .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\canadian sperm catfight balls .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\xxx [milf] .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\animal sperm masturbation (Janette).zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exec9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exec9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exepid Process 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 2544 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exec9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exedescription pid Process procid_target PID 2224 wrote to memory of 2992 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 28 PID 2224 wrote to memory of 2992 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 28 PID 2224 wrote to memory of 2992 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 28 PID 2224 wrote to memory of 2992 2224 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 28 PID 2992 wrote to memory of 2544 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 29 PID 2992 wrote to memory of 2544 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 29 PID 2992 wrote to memory of 2544 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 29 PID 2992 wrote to memory of 2544 2992 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe"C:\Users\Admin\AppData\Local\Temp\c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe"C:\Users\Admin\AppData\Local\Temp\c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe"C:\Users\Admin\AppData\Local\Temp\c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2544
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1023KB
MD5fb784116f908827499ad2eb224ce85ed
SHA197cc0f3f8b1fad768eb689a5c752b51f95d68626
SHA256452a4d5e51b00eb5da19b57b049a1e5244922aef41cf7456a8cd470bdde9cfea
SHA5125c20490d63d0c180f97df7aea0fc4f303d10aa224247b471c8dbf786ec30f27866c852a74fa6c5a5c67311f5791e783a36eca4951db49f3b379f219c1f6d8d69
-
Filesize
183B
MD5322fb3f0bef77a2e1f93a03e4a65816d
SHA1242b156c1d8c8dfea4345972ee0ff50018e00185
SHA2562df76267bac06d3edc88aa82435b645576c9b054e56b43a94d363b3185ae5111
SHA5126fd93b54931f9232032d1d7a564be633a681ba531a7557985e81bc2865bf4f7e31616c723ba3f8c066d0447288dd98f7397e76179e796b94c965ddf0a2b6e06d