Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 01:25
Static task
static1
Behavioral task
behavioral1
Sample
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe
Resource
win10v2004-20240226-en
General
-
Target
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe
-
Size
292KB
-
MD5
a3bc5a1f20e21874d56c71282c3104fe
-
SHA1
90e6f287921d4a59ee7df91dacc191ab1645fff9
-
SHA256
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d
-
SHA512
ed8966e993aa10c42b433b8b1f09ea8087a2a63869adacfb3c27eb365fab43259581abc265279fa6fd0b7c1087867b70d1a36626ec0ff39b5ade35c653b2fecc
-
SSDEEP
6144:dXC4vgmhbIxs3NBR3BHgPZacfQbdErY1iMbnz3Vq8ukh6KQFZE:dXCNi9BHg0VbWGX3VQp2
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
Processes:
resource yara_rule behavioral2/files/0x000a00000002312d-4.dat INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exec9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exedescription ioc Process File opened (read-only) \??\B: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\N: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\R: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\Z: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\E: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\S: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\V: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\H: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\I: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\P: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\T: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\Y: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\A: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\G: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\J: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\K: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\L: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\M: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\O: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\Q: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\U: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\W: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File opened (read-only) \??\X: c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe -
Drops file in System32 directory 12 IoCs
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exedescription ioc Process File created C:\Windows\SysWOW64\FxsTmp\african xxx hot (!) (Samantha).mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\swedish cum bukkake lesbian glans .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\config\systemprofile\lingerie big cock .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\IME\SHARED\indian handjob xxx masturbation sm (Kathrin,Melissa).mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\xxx [free] upskirt .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\System32\DriverStore\Temp\lesbian lesbian feet boots .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\IME\SHARED\swedish porn fucking voyeur .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\lingerie catfight fishy .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\bukkake girls (Jade).zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\FxsTmp\lesbian hot (!) (Curtney).zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\tyrkish fetish horse public titts mistress (Curtney).mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SysWOW64\config\systemprofile\bukkake uncut titts bondage .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe -
Drops file in Program Files directory 18 IoCs
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exedescription ioc Process File created C:\Program Files (x86)\Google\Update\Download\bukkake [bangbus] traffic (Sonja,Liz).zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files\Common Files\microsoft shared\xxx licking titts swallow .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\japanese porn bukkake full movie hairy .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\italian gang bang hardcore public sweet .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\danish nude beast uncut sm (Kathrin,Liz).mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files\dotnet\shared\american beastiality beast hidden latex (Sandy,Liz).rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\tyrkish action gay catfight ash .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\brasilian kicking lingerie hidden hole latex (Liz).rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Microsoft\Temp\american cumshot lesbian hidden glans gorgeoushorny (Samantha).zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Google\Temp\american porn hardcore big .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\gay voyeur ash .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\beast big hotel .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files\Microsoft Office\root\Templates\beast hot (!) bedroom .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\hardcore full movie hole (Kathrin,Sarah).mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\horse licking glans ΋ (Samantha).zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files\Microsoft Office\Updates\Download\swedish porn lingerie [free] hole 40+ .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\porn bukkake sleeping glans castration .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\trambling [free] sweet (Kathrin,Liz).mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe -
Drops file in Windows directory 64 IoCs
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exedescription ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\trambling [milf] titts (Sandy,Melissa).mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\nude horse hot (!) cock mistress (Curtney).mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.746_none_4cfe603abbcbfd86\tyrkish animal trambling public black hairunshaved .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\spanish fucking several models (Janette).mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\xxx licking hotel .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\brasilian cum bukkake uncut sm .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\american beastiality lingerie big hole swallow .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\swedish fetish fucking several models glans .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\brasilian nude bukkake uncut hole gorgeoushorny .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\nude blowjob masturbation .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\danish porn lesbian hot (!) glans shoes .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\malaysia lesbian uncut cock .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\blowjob big .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\danish animal trambling hidden feet (Sandy,Liz).zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\tmp\danish beastiality hardcore catfight cock .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\Downloaded Program Files\danish fetish fucking masturbation .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\african lesbian licking cock gorgeoushorny .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\fetish sperm [milf] upskirt .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\trambling voyeur leather .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\african xxx voyeur .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\japanese gang bang fucking girls glans blondie (Karin).zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\french horse lesbian .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\horse uncut feet .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f8d34ba1b1eb00de\gay voyeur 40+ (Anniston,Jade).mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\black porn xxx uncut .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\porn sperm [bangbus] hairy .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\italian action horse big black hairunshaved .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\chinese beast hot (!) .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\CbsTemp\swedish fetish lesbian [free] glans .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\black nude sperm voyeur bondage .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\hardcore several models .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\norwegian beast voyeur 40+ .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\beastiality fucking full movie ash .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\PLA\Templates\xxx masturbation shower .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_a4327320c19e2fa7\swedish kicking beast full movie cock mistress (Curtney).mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_4ab14109a3e1e067\trambling public .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\black horse trambling sleeping (Sarah).mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\spanish fucking [milf] femdom .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\blowjob [free] feet Ôï .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\spanish sperm sleeping cock .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\action sperm several models swallow .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\spanish sperm girls glans bedroom .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\italian gang bang fucking hidden bondage (Gina,Liz).mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\horse sperm girls (Samantha).mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\danish fetish lingerie hot (!) cock traffic (Melissa).mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\german trambling masturbation .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\blowjob [milf] titts .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\brasilian gang bang blowjob uncut .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\beast [milf] (Janette).mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\mssrv.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\lingerie [milf] 40+ .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\horse gay licking YEâPSè& .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\russian nude trambling big hole shoes .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\swedish fetish horse hot (!) redhair .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.1_none_5a23b464e1e0b15e\indian beastiality gay big .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\beastiality sperm full movie young .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\chinese lingerie girls girly .mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\beast public high heels .avi.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\italian nude trambling girls cock .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\lingerie masturbation wifey .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\nude xxx uncut .rar.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\tyrkish fetish horse public wifey .mpeg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\black porn lingerie big leather .zip.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\russian handjob lingerie voyeur girly (Gina,Liz).mpg.exe c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exec9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exec9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exepid Process 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 1280 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exec9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exedescription pid Process procid_target PID 656 wrote to memory of 4620 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 90 PID 656 wrote to memory of 4620 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 90 PID 656 wrote to memory of 4620 656 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 90 PID 4620 wrote to memory of 1280 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 95 PID 4620 wrote to memory of 1280 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 95 PID 4620 wrote to memory of 1280 4620 c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe"C:\Users\Admin\AppData\Local\Temp\c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe"C:\Users\Admin\AppData\Local\Temp\c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe"C:\Users\Admin\AppData\Local\Temp\c9ca20d0d00ce8644fad6f4fe7c50218f810b42e19f86d73581ae67dca9b070d.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1280
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\hardcore full movie hole (Kathrin,Sarah).mpg.exe
Filesize1.2MB
MD53dedeb0b29c7fd82f955c362f612c844
SHA1a2dc4adc5540151fc1432bd8bd88eae1bde8c807
SHA256bf52da888ae2f8fb0acb2682a17a48243411e43aa0a461d37857877322e2cad3
SHA5127a297d9f2e14a53211e5a29ddd11591ca737b41e7bf515563c6f3c8fa8a2f7f281fb42a0f466a261101e07322c1ecf8a0583614e62f21a50cdf61ebf384c3572