Analysis
-
max time kernel
180s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 22:50
Behavioral task
behavioral1
Sample
75f3160766a7de66f521fb5e79e9bf0c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
75f3160766a7de66f521fb5e79e9bf0c.exe
Resource
win10v2004-20240319-en
General
-
Target
75f3160766a7de66f521fb5e79e9bf0c.exe
-
Size
769KB
-
MD5
75f3160766a7de66f521fb5e79e9bf0c
-
SHA1
8c0acc261ecea9f2c6dc3d6f2a703ac94c247fec
-
SHA256
3394dfede283a3ae7006f71886453bae563663edb8ed0328ade3326682c505ae
-
SHA512
c7686c3605a5fa7d13ea169ff9184ba49531c02a30574ebcdb506432ef66a24683574cfa822ce332c0099cdf78c346062718f79a43e0aeb551ae2b25884efd15
-
SSDEEP
24576:YoY4FlXqQuWEzCueA6jUZTHv1zUiqDjU1+Kpqe73Ct:XXFlXbEzaA6QxUiqoqr
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation 75f3160766a7de66f521fb5e79e9bf0c.exe Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation 75f3160766a7de66f521fb5e79e9bf0c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1976-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/files/0x0008000000023327-5.dat upx behavioral2/memory/3104-11-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2172-13-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4368-14-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1976-93-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3104-100-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2172-103-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4368-104-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 75f3160766a7de66f521fb5e79e9bf0c.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\Z: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\A: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\B: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\I: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\J: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\O: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\Q: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\Y: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\P: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\R: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\U: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\V: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\H: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\K: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\L: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\M: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\W: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\X: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\E: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\G: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\N: 75f3160766a7de66f521fb5e79e9bf0c.exe File opened (read-only) \??\T: 75f3160766a7de66f521fb5e79e9bf0c.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\xxx lingerie full movie boobs .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\nude lesbian vagina wifey (Melissa,Janette).rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\System32\DriverStore\Temp\porn trambling lesbian boobs .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\SysWOW64\IME\SHARED\american lingerie [bangbus] cock .rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\japanese bukkake beast masturbation granny .mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\american lingerie [milf] legs boots .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\SysWOW64\FxsTmp\indian gay action [bangbus] YEâPSè& (Sylvia,Gina).zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\SysWOW64\IME\SHARED\british cum gang bang girls granny (Melissa).mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\chinese lingerie beastiality masturbation glans wifey .mpeg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\SysWOW64\config\systemprofile\indian gay hot (!) pregnant (Janette).avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\SysWOW64\FxsTmp\french gay sleeping .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\asian action animal licking (Christine,Janette).avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe -
Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\british horse catfight .rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\german fetish girls .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\xxx masturbation titts .rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files (x86)\Google\Temp\chinese lesbian handjob big blondie (Sonja).mpeg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files (x86)\Google\Update\Download\indian trambling gang bang full movie (Sarah,Melissa).zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\fetish beast girls .mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files\Common Files\microsoft shared\german action porn licking circumcision .mpeg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\beast catfight ash granny (Curtney,Melissa).mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\nude hardcore licking bondage .mpeg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{D3EA2F86-0081-495C-8439-1E64CA71F999}\EDGEMITMP_57EE5.tmp\french hardcore fetish lesbian redhair .mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files (x86)\Microsoft\Temp\swedish horse nude [milf] ejaculation (Samantha,Karin).rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fucking cum public ash .zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian handjob voyeur hole .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files\Microsoft Office\root\Templates\fucking beastiality [milf] .zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\bukkake beast [free] .mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files\Microsoft Office\Updates\Download\spanish cumshot beast sleeping boobs .zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\trambling uncut vagina (Jade).avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\trambling lingerie full movie shoes .zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Program Files\dotnet\shared\porn lingerie lesbian .zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\chinese sperm uncut (Samantha,Tatjana).mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\malaysia fetish gang bang uncut glans sm .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\asian animal beastiality catfight (Sonja,Sylvia).rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\spanish nude lingerie catfight shoes .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\handjob cumshot several models castration .rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\indian lingerie blowjob girls beautyfull .mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\norwegian action hot (!) glans 50+ (Sonja,Ashley).avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\african xxx kicking uncut feet .rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\fetish licking titts .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\CbsTemp\american gay catfight swallow .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\beastiality lesbian hidden (Janette,Samantha).zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\blowjob catfight vagina wifey .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\PLA\Templates\sperm public titts 40+ .rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\brasilian fucking voyeur (Tatjana,Karin).mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\fucking beast girls .rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\indian beastiality lesbian full movie (Sarah,Sonja).mpeg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\german nude cum [bangbus] cock YEâPSè& .zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\cumshot blowjob public mistress .mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\tyrkish action catfight lady .mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\xxx uncut (Kathrin,Gina).mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\indian cumshot voyeur boots (Sylvia).rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\asian lesbian porn hidden high heels (Samantha,Karin).zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\Downloaded Program Files\danish porn masturbation .mpeg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\horse catfight boobs .zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\german cumshot catfight .rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\indian sperm nude [free] mistress .mpeg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\sperm beast [free] .mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\gang bang [free] glans .rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\beast horse hot (!) .mpeg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\canadian horse beast voyeur balls .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\SoftwareDistribution\Download\french kicking [bangbus] .mpeg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\black blowjob [milf] vagina boots (Sonja).rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\kicking voyeur mature .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\kicking gang bang hidden balls .mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\gang bang blowjob sleeping ash .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\chinese cum kicking catfight titts .mpeg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\beastiality bukkake hot (!) mature (Gina).rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\InputMethod\SHARED\fucking cumshot [free] cock black hairunshaved (Sylvia,Janette).mpeg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\security\templates\german porn public .zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\cumshot masturbation titts young .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\canadian trambling [free] .rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\animal porn masturbation hairy (Britney).rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\norwegian beastiality kicking licking .zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\spanish fetish [free] (Samantha,Curtney).rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\african gang bang action voyeur legs beautyfull .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\indian trambling trambling [free] .zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\mssrv.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\fetish sperm public wifey .mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\american gay girls .zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\horse sperm several models .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\italian fetish girls (Karin).rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\gay horse hot (!) feet .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\lingerie xxx lesbian .mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\italian horse uncut blondie .mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\horse bukkake several models vagina hotel .zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\asian porn bukkake licking .mpg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\chinese cumshot several models (Ashley).avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\action porn hidden sweet (Curtney).rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\german bukkake cum uncut fishy .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\malaysia nude big (Karin).avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\russian blowjob handjob hot (!) girly .mpeg.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\american hardcore gay licking cock (Curtney).zip.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\horse lingerie [bangbus] titts redhair .avi.exe 75f3160766a7de66f521fb5e79e9bf0c.exe File created C:\Windows\assembly\tmp\swedish kicking uncut fishy (Karin).rar.exe 75f3160766a7de66f521fb5e79e9bf0c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 4368 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 4368 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 4368 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 4368 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 4368 75f3160766a7de66f521fb5e79e9bf0c.exe 4368 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 4368 75f3160766a7de66f521fb5e79e9bf0c.exe 4368 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 4368 75f3160766a7de66f521fb5e79e9bf0c.exe 4368 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 4368 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 4368 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 4368 75f3160766a7de66f521fb5e79e9bf0c.exe 4368 75f3160766a7de66f521fb5e79e9bf0c.exe 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe 2172 75f3160766a7de66f521fb5e79e9bf0c.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1976 wrote to memory of 3104 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 100 PID 1976 wrote to memory of 3104 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 100 PID 1976 wrote to memory of 3104 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 100 PID 1976 wrote to memory of 2172 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 101 PID 1976 wrote to memory of 2172 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 101 PID 1976 wrote to memory of 2172 1976 75f3160766a7de66f521fb5e79e9bf0c.exe 101 PID 3104 wrote to memory of 4368 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 102 PID 3104 wrote to memory of 4368 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 102 PID 3104 wrote to memory of 4368 3104 75f3160766a7de66f521fb5e79e9bf0c.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\75f3160766a7de66f521fb5e79e9bf0c.exe"C:\Users\Admin\AppData\Local\Temp\75f3160766a7de66f521fb5e79e9bf0c.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\75f3160766a7de66f521fb5e79e9bf0c.exe"C:\Users\Admin\AppData\Local\Temp\75f3160766a7de66f521fb5e79e9bf0c.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\75f3160766a7de66f521fb5e79e9bf0c.exe"C:\Users\Admin\AppData\Local\Temp\75f3160766a7de66f521fb5e79e9bf0c.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4368
-
-
-
C:\Users\Admin\AppData\Local\Temp\75f3160766a7de66f521fb5e79e9bf0c.exe"C:\Users\Admin\AppData\Local\Temp\75f3160766a7de66f521fb5e79e9bf0c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2244,i,861925222566734100,5228329984880658054,262144 --variations-seed-version /prefetch:81⤵PID:3056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian handjob voyeur hole .avi.exe
Filesize232KB
MD541dbed0bfc7dc50b207603cf028ace42
SHA16ecaf165ca7291ef42c32e17055d90c046de8dbe
SHA256275aa3e8cc20a5afc2f7d394dd7f0449d89730b7e93ce6b5224d544251ba45b4
SHA512f4460181032ff2c64e8b09d7f6de4cca9999f929aaa66b10485832686ac10280d5e0ad74649b963ea802ad67a6a97b5c5bb4f6e043d286e0cab527135243ec74