Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 01:17
Behavioral task
behavioral1
Sample
b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe
Resource
win10v2004-20240226-en
General
-
Target
b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe
-
Size
1.3MB
-
MD5
33ee8c3312c78a5363b117099fb09fca
-
SHA1
592439f7ab2e6470957dc2f2b817e3fb4fce8254
-
SHA256
b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad
-
SHA512
a582162d49dff646ea747fb5879c9383e3512d64abc82b052f11e36b05f822fc46711f532f2a196d762aefa65e045f5b8191e004e64ac42d1243ae5935e113a9
-
SSDEEP
24576:Yi3f9FjSvm3MOe1Tgy8S6DYHBFCFXWiRBkkz9vG+AK4oXdoaizhOKgG:x3fHomc11Tgy8lqwFXWiRGk9GXbadG
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 6 IoCs
resource yara_rule behavioral2/memory/4980-16-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4132-34-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3420-193-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4980-195-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4132-199-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2320-200-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral2/memory/3420-0-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/files/0x000a000000023139-5.dat UPX behavioral2/memory/4980-16-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/4132-34-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/2320-36-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3420-193-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/4980-195-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/4132-199-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/2320-200-0x0000000000400000-0x0000000000420000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3420-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000a000000023139-5.dat upx behavioral2/memory/4980-16-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4132-34-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2320-36-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3420-193-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4980-195-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4132-199-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2320-200-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\T: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\V: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\W: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\Y: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\Z: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\I: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\Q: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\M: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\N: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\A: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\J: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\U: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\X: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\K: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\P: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\G: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\H: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\L: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\O: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\R: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\B: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File opened (read-only) \??\E: b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\System32\LogFiles\Fax\Incoming\russian gang bang hardcore girls castration (Britney,Janette).avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\xxx several models cock mistress .avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\System32\DriverStore\Temp\hardcore sleeping young .zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\SysWOW64\FxsTmp\horse girls .zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\SysWOW64\IME\SHARED\horse [milf] granny .rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\bukkake catfight ash .zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\SysWOW64\config\systemprofile\lesbian uncut castration .mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\SysWOW64\FxsTmp\swedish fetish sperm catfight .avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\SysWOW64\IME\SHARED\black cum horse big beautyfull .rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\american action lesbian sleeping 50+ .avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\SysWOW64\config\systemprofile\bukkake girls shoes .zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\american action lingerie full movie hotel .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\italian kicking horse licking glans leather .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files (x86)\Google\Temp\italian handjob bukkake [milf] shoes .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\brasilian cumshot trambling [milf] cock latex (Sarah).avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\indian cumshot beast lesbian granny .mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\american nude gay uncut redhair .mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files\Common Files\microsoft shared\russian cum xxx girls high heels .mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files\Microsoft Office\Updates\Download\japanese nude xxx several models gorgeoushorny .zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\black cum xxx lesbian leather .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\cumshot lesbian [milf] upskirt .mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\fucking full movie (Liz).avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files (x86)\Google\Update\Download\swedish kicking hardcore uncut (Janette).mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\brasilian gang bang fucking big hole .zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\bukkake lesbian hole .mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files\Microsoft Office\root\Templates\italian kicking xxx several models (Liz).mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\blowjob hidden hole sm .rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\sperm big hole hairy (Sylvia).avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files (x86)\Microsoft\Temp\gay catfight hole hotel .mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Program Files\dotnet\shared\swedish porn trambling [free] (Curtney).mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\italian kicking beast [milf] .mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\black fetish gay catfight cock blondie (Curtney).avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\assembly\tmp\american animal trambling big hole .rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\asian fucking full movie mature .avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\japanese beastiality bukkake catfight titts .zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_it-it_1a80ce63d483fe70\hardcore big feet shower (Samantha).zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\norwegian gay hidden titts penetration (Jade).zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\Temp\gay public hole granny (Curtney).rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\african trambling sleeping (Sylvia).mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\japanese fetish lesbian hot (!) glans fishy .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\spanish xxx [milf] cock mistress (Sylvia).mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\japanese beastiality blowjob hot (!) .rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\sperm lesbian .rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\danish gang bang beast [milf] glans castration (Janette).rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\gang bang trambling lesbian cock high heels (Melissa).avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\bukkake big sweet (Ashley,Liz).rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\blowjob full movie hole .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\gang bang lesbian licking (Sylvia).mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f8d34ba1b1eb00de\indian nude trambling lesbian latex .zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\italian cum gay hidden .mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\handjob gay [milf] .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\black cumshot gay hot (!) .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\indian cum gay licking .rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\fucking several models 50+ .mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\african fucking [bangbus] titts boots (Melissa).mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\black animal beast hidden upskirt .avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\tyrkish cumshot fucking catfight .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\spanish beast [free] boots .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\british lesbian sleeping young (Sandy,Jade).mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\beastiality blowjob [free] hole beautyfull (Karin).zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\mssrv.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\swedish fetish sperm masturbation cock gorgeoushorny (Sylvia).avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\handjob lesbian several models blondie (Gina,Samantha).mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\blowjob hot (!) hole .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\chinese lesbian uncut titts .zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\norwegian bukkake [milf] castration .avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\canadian blowjob girls feet bondage .rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\brasilian nude trambling public (Melissa).zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.1_none_813610a8a9b59e0a\chinese xxx several models (Jade).mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\african hardcore uncut glans boots .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\assembly\temp\tyrkish fetish xxx big glans lady (Melissa).mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\horse voyeur glans .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\african hardcore girls feet .mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\brasilian porn xxx licking .mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\fetish lesbian masturbation cock hotel .zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\animal gay [free] titts ash (Sylvia).rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\spanish beast sleeping femdom (Sonja,Tatjana).avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\french xxx several models cock penetration (Janette).rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\gay [free] (Sarah).avi.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\kicking gay lesbian glans girly (Jade).mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\lingerie lesbian shoes (Christine,Jade).zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\black kicking hardcore [bangbus] hole (Britney,Karin).zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\hardcore [milf] YEâPSè& (Sonja,Curtney).mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\cumshot gay hot (!) feet .mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\InputMethod\SHARED\beast full movie redhair .rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.1_none_5a23b464e1e0b15e\russian handjob xxx sleeping feet upskirt .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\action lesbian sleeping high heels .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\chinese beast lesbian bedroom .mpeg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\brasilian fetish lingerie [bangbus] glans .zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\indian nude lesbian hot (!) mature .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\x86_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_231ddfc33015c6db\british blowjob girls cock .mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\PLA\Templates\xxx uncut redhair .zip.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\african bukkake hidden gorgeoushorny (Kathrin,Sylvia).mpg.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_c9ce604ef4cbf323\chinese beast girls titts .rar.exe b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 2320 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 2320 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 2320 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 2320 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 2320 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 2320 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 2320 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 2320 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 2320 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 2320 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 2320 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 2320 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 2320 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 2320 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 4132 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3420 wrote to memory of 4980 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 89 PID 3420 wrote to memory of 4980 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 89 PID 3420 wrote to memory of 4980 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 89 PID 3420 wrote to memory of 4132 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 92 PID 3420 wrote to memory of 4132 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 92 PID 3420 wrote to memory of 4132 3420 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 92 PID 4980 wrote to memory of 2320 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 93 PID 4980 wrote to memory of 2320 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 93 PID 4980 wrote to memory of 2320 4980 b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe"C:\Users\Admin\AppData\Local\Temp\b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe"C:\Users\Admin\AppData\Local\Temp\b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe"C:\Users\Admin\AppData\Local\Temp\b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2320
-
-
-
C:\Users\Admin\AppData\Local\Temp\b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe"C:\Users\Admin\AppData\Local\Temp\b0a996b11e62f94e2177e02d95fab1972dbacede91887dbeccd58a4ff7765cad.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\brasilian cumshot trambling [milf] cock latex (Sarah).avi.exe
Filesize1.4MB
MD5841735baa16778d994871aef59f84218
SHA15693e8ba60406c2dfe67f66410b18950fa8dae01
SHA256ee21bb2faa968c2b7c7019b3800b6a0b3f4e93bfb74bc003546113df3ec0c82e
SHA512bee12710fc4a8390345b6f4ded2b06491d9f69a10fa2fd105904c367a72ce3c75dbd35fd61b6eb4759544cb46a22b3ef2e86d3575d78c71873843254a9a43c3f