Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
09/04/2024, 22:20
Behavioral task
behavioral1
Sample
416ecc3e7a04e5539213a1fabe676b9b.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
416ecc3e7a04e5539213a1fabe676b9b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 416ecc3e7a04e5539213a1fabe676b9b.exe
- Size 2.0MB
- Sample240409-189e5sed62
- SHA256 744df2bf8cdd01a0aabdce41163d1afaa7fc8a6d24a251cb827ac5c4a04e1f8c
- MD5 416ecc3e7a04e5539213a1fabe676b9b
- SHA1 d5db9c24f32f72b243ba297cf999573d659ecfdb
- SHA512 468a3096b5aa1b6aeb904c3a62096ea5f4c739b7e25be9c58a29fa089632b2b0344a1ac4ef580da00940e1009ec721dc66cc16bc3cea743d94b716c2e49f7ca0
- SSDEEP 24576:t2gC7mNdosj6Aqb1eaOXTA/FNyA/kSnM5Nh2XABwE9t72ggdiG2fcwnjYNJi4B5C:QgC7mNgSXT2yHAkhnpt72cxdJ4BiBnT
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 416ecc3e7a04e5539213a1fabe676b9b.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 416ecc3e7a04e5539213a1fabe676b9b.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1536-0-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/files/0x000200000001e6b0-5.dat upx behavioral2/memory/3088-35-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-186-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3088-187-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2104-189-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/768-190-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-191-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-192-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-198-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-208-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-212-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-217-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-221-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-225-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-229-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-233-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-237-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-241-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-245-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1536-249-0x0000000000400000-0x000000000041D000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 416ecc3e7a04e5539213a1fabe676b9b.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\W: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\X: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\B: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\I: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\P: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\R: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\G: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\T: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\U: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\V: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\K: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\O: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\Q: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\L: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\M: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\N: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\Y: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\A: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\E: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\H: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\J: 416ecc3e7a04e5539213a1fabe676b9b.exe File opened (read-only) \??\Z: 416ecc3e7a04e5539213a1fabe676b9b.exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\french sperm [milf] beautyfull (Ashley).zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\IME\SHARED\handjob public ejaculation .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\spanish handjob porn several models castration .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\config\systemprofile\danish sperm several models (Kathrin).zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\FxsTmp\canadian horse full movie hole (Curtney,Sonja).mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\IME\SHARED\porn hidden fishy (Kathrin,Gina).mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\System32\DriverStore\Temp\bukkake big (Gina).mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\FxsTmp\danish beast porn full movie glans leather (Anniston,Sarah).zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\horse public stockings (Tatjana).zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\fetish [milf] glans redhair .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\japanese action sleeping boobs penetration .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\french animal voyeur .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe - Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\black kicking [free] .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Google\Temp\animal action [milf] feet .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Google\Update\Download\danish lesbian cum sleeping upskirt .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Microsoft\Temp\horse several models .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files\Common Files\microsoft shared\danish horse lingerie [milf] stockings (Liz).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files\dotnet\shared\indian action [milf] black hairunshaved .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\black cum sperm uncut titts swallow (Janette,Sonja).zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\norwegian xxx cumshot uncut hole .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\animal hot (!) boots .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files\Microsoft Office\root\Templates\danish cum big .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files\Microsoft Office\Updates\Download\french xxx girls hole circumcision .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\asian cumshot several models bondage .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\fetish girls lady .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\beast trambling girls (Britney).mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\british bukkake beast catfight boobs fishy (Karin).avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\kicking cumshot several models young .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\hardcore [bangbus] wifey .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\swedish hardcore sperm sleeping shoes .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\handjob gang bang uncut hairy .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\tyrkish beast full movie boobs (Sandy,Sandy).avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\canadian porn sleeping vagina .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\blowjob trambling [bangbus] (Jade).avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\hardcore girls (Kathrin,Curtney).zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\asian fucking full movie ash femdom .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\beast fucking voyeur boots (Jenna,Ashley).mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\swedish horse public circumcision (Melissa,Tatjana).zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\indian lingerie gay full movie balls (Britney,Anniston).avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\brasilian porn cum big boots (Sylvia,Christine).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\beastiality hidden 40+ .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\trambling lesbian [bangbus] shoes .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.746_none_4cfe603abbcbfd86\action porn voyeur upskirt (Jenna,Sandy).avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\trambling horse big granny (Britney).mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\malaysia action gang bang voyeur (Samantha,Liz).mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\kicking beastiality hidden hotel (Melissa,Gina).mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\swedish beast fucking masturbation blondie .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\animal fetish [bangbus] lady (Gina,Melissa).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\french lesbian horse voyeur .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\american hardcore gay licking shower .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_it-it_1a80ce63d483fe70\sperm catfight penetration (Kathrin).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\cum fetish full movie balls .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\nude handjob big shower .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\assembly\temp\beast hot (!) ash .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\PLA\Templates\sperm several models black hairunshaved .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\danish cumshot several models hairy .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\nude licking (Christine).zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\american cumshot horse licking glans (Kathrin,Gina).avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\canadian cum big femdom .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\russian porn [bangbus] .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\british fetish cumshot masturbation 40+ (Samantha,Sylvia).mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\sperm hardcore [bangbus] Ôï (Sandy).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\indian handjob lingerie public vagina latex .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\danish lesbian horse sleeping .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\black bukkake licking fishy .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\asian trambling gang bang big .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\beast handjob hot (!) upskirt .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_93c5f32b7859ec4f\brasilian bukkake hidden boobs high heels .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\beast public legs upskirt .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\cum hidden stockings .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\british horse masturbation castration .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f8d34ba1b1eb00de\cumshot beast hidden legs .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\canadian sperm lesbian uncut gorgeoushorny (Samantha,Gina).zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\animal hardcore hot (!) nipples girly (Jade,Sylvia).avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\canadian bukkake voyeur lady .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\african porn hidden legs penetration .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\indian horse hidden .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\asian kicking public sweet .rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\asian gay fucking [free] (Karin).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\indian beastiality public ash bedroom .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bca64d70c79f104b\chinese hardcore licking ash girly .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\malaysia trambling lesbian .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\black xxx action voyeur gorgeoushorny (Jenna,Melissa).mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\german blowjob animal sleeping gorgeoushorny .zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\british cumshot fucking lesbian boobs latex .avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\malaysia beastiality girls hole (Jade,Christine).avi.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\german nude gay girls (Sonja).zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\norwegian porn hidden .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\british trambling nude girls (Karin,Sonja).rar.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\cum action hidden wifey .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\cumshot hot (!) (Kathrin,Sonja).zip.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\canadian kicking horse full movie legs leather .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\kicking cumshot girls legs 40+ .mpg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\beast gang bang uncut .mpeg.exe 416ecc3e7a04e5539213a1fabe676b9b.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 768 416ecc3e7a04e5539213a1fabe676b9b.exe 768 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 768 416ecc3e7a04e5539213a1fabe676b9b.exe 768 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 768 416ecc3e7a04e5539213a1fabe676b9b.exe 768 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 768 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 768 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 768 416ecc3e7a04e5539213a1fabe676b9b.exe 768 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 768 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 768 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 768 416ecc3e7a04e5539213a1fabe676b9b.exe 768 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe 2104 416ecc3e7a04e5539213a1fabe676b9b.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1536 wrote to memory of 3088 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 87 PID 1536 wrote to memory of 3088 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 87 PID 1536 wrote to memory of 3088 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 87 PID 1536 wrote to memory of 2104 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 88 PID 1536 wrote to memory of 2104 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 88 PID 1536 wrote to memory of 2104 1536 416ecc3e7a04e5539213a1fabe676b9b.exe 88 PID 3088 wrote to memory of 768 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 89 PID 3088 wrote to memory of 768 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 89 PID 3088 wrote to memory of 768 3088 416ecc3e7a04e5539213a1fabe676b9b.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:768
-
-
-
C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"C:\Users\Admin\AppData\Local\Temp\416ecc3e7a04e5539213a1fabe676b9b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2104
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\beast trambling girls (Britney).mpg.exe
- Size 664KB
- SHA256 c43ecc2093c1a41c89f06a7453c0b385cb794a700f6535bdd5d1bde363de130f
- MD5 887447f115088736ef5d596a72b65718
- SHA1 3f174b68dc6ac2112a281731bb600d1e73681a6d
- SHA512 e6d0fb93ed9d565d881468cd7d99625b06db7c43e343c167c4b0505f77a78f555faf849489f3ab6966fae9e92e1d532e566cfb4312039e358a1aa5a0b366e0ba
- SSDEEP 12288:tEQoS9qhPPYWX9sfpC+O2TewSNdU/fhdHNpVO7UUhJivE8dmWpFADT:t2HRX9sfpu2TewIdU/pdti7UIMv3AW3S
- MD5 SHA1 SHA512 SSDEEP