Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 03:39
Behavioral task
behavioral1
Sample
dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe
Resource
win10v2004-20240226-en
General
-
Target
dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe
-
Size
1.2MB
-
MD5
b2a75aa3954c3394702beb7fded2d106
-
SHA1
fe60afcae7c866aa78baeaffa0ffb21ff5a11d59
-
SHA256
dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572
-
SHA512
acac3b031ac2ada8dcdf9646bb96e741e6a9420fe3fe99a9cba486fce8d21e77a9fdd5a58b0ec2aab2aa1b60e44517c581dbc7d6a0c0cd5a3805df38dbc381ef
-
SSDEEP
24576:sSLOZt1yOHm/LxJ3kmYkHPS/Q9tqxQZFTa4CYvLzZtYMhlSs:sTyN/L/Rxa/CtQQZF2evLdtYMD5
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000700000002322e-5.dat UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/2956-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x000700000002322e-5.dat upx behavioral2/memory/1132-100-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1052-168-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1872-169-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2956-197-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1132-200-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1052-201-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1872-202-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\I: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\Q: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\S: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\V: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\U: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\X: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\Z: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\B: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\E: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\O: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\P: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\T: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\W: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\R: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\A: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\G: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\J: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\K: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\L: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\M: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\N: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File opened (read-only) \??\Y: dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\indian nude blowjob masturbation girly .avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\System32\DriverStore\Temp\beast [free] (Tatjana).rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\italian fetish xxx full movie (Liz).mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\bukkake hot (!) hole .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\bukkake girls hole black hairunshaved .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\xxx full movie glans .avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\SysWOW64\FxsTmp\asian gay [milf] titts balls (Tatjana).avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\SysWOW64\IME\SHARED\italian cum gay [free] wifey .mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\sperm [free] hole 50+ (Sylvia).rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\SysWOW64\config\systemprofile\sperm [bangbus] .avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\SysWOW64\FxsTmp\fucking [bangbus] sm .mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\SysWOW64\IME\SHARED\bukkake [milf] glans shower (Karin).mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\italian cumshot fucking catfight cock femdom (Sarah).mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\american horse sperm voyeur titts Ôï (Janette).avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files (x86)\Google\Temp\tyrkish horse lingerie licking feet .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files (x86)\Google\Update\Download\italian gang bang sperm licking bedroom .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files (x86)\Microsoft\Temp\italian fetish sperm girls feet .zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files\Common Files\microsoft shared\brasilian beastiality beast [milf] cock .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files\dotnet\shared\lingerie public shower .avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\german horse big hotel .zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\russian cumshot hardcore [bangbus] fishy .rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\fucking lesbian .rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files\Microsoft Office\Updates\Download\brasilian porn fucking uncut glans castration .zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\lesbian sleeping hole stockings .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\blowjob lesbian circumcision .rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files\Microsoft Office\root\Templates\american cum gay [bangbus] cock wifey (Sylvia).zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\japanese cumshot sperm catfight .zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\russian porn beast [free] .mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\blowjob sleeping circumcision (Sonja,Liz).zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\lesbian public (Samantha).rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\beastiality beast several models .rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\african lingerie voyeur .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\danish nude blowjob [milf] YEâPSè& .mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\italian cum bukkake hidden hole .mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\american cum hardcore catfight glans stockings .avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\cum trambling [bangbus] titts sm (Sylvia).mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\canadian sperm uncut .avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bca64d70c79f104b\chinese trambling masturbation titts mature (Melissa).avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\lingerie lesbian castration .rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\chinese sperm hidden hole traffic .zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\gang bang trambling hidden shower .rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\hardcore big .mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\kicking hardcore [milf] feet .avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\action hardcore hidden glans fishy .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\black nude horse catfight glans hairy .rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\spanish gay masturbation .zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\gang bang xxx sleeping titts .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\indian gang bang lingerie lesbian sm .mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\hardcore girls 40+ .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\action beast voyeur .avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\canadian lingerie sleeping granny .avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\horse hardcore voyeur mature .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\xxx sleeping feet .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\fucking [free] titts mistress .zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\asian sperm [free] (Sarah).zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\fucking [free] .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\british lingerie licking hole .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\british fucking public .zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\malaysia hardcore full movie bedroom .mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\handjob hardcore big titts castration .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\danish cum fucking several models fishy .avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\porn beast [milf] .avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\chinese lingerie catfight sm .mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\canadian lingerie lesbian glans .mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\norwegian xxx licking cock .rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\cumshot blowjob public cock .zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\french sperm hidden (Janette).mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\spanish blowjob licking feet .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\PLA\Templates\black horse bukkake voyeur cock .rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\brasilian kicking gay masturbation glans .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\malaysia fucking lesbian (Jade).zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\spanish lesbian [free] feet .zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\action hardcore catfight hole swallow .rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\norwegian sperm big .avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\chinese gay masturbation pregnant .avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\norwegian trambling [free] glans Ôï .mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\kicking xxx girls hole ejaculation (Sylvia).mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\brasilian beastiality trambling big bedroom (Christine,Curtney).rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\black action xxx lesbian castration .zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\hardcore masturbation feet .avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\animal blowjob several models stockings .zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\gay full movie .mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\Downloaded Program Files\american animal gay [milf] (Tatjana).mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\canadian gay catfight hole young (Melissa).avi.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\indian cum lingerie voyeur penetration .zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\norwegian hardcore big cock (Sonja,Sarah).mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\black cumshot bukkake big glans (Ashley,Curtney).zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\swedish nude lingerie [bangbus] titts .zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\danish fetish fucking [bangbus] (Curtney).zip.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\InputMethod\SHARED\xxx hidden (Karin).mpeg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\fetish horse hot (!) hole (Ashley,Janette).mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\porn bukkake full movie .mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\danish animal fucking hot (!) hole pregnant .rar.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.746_none_4cfe603abbcbfd86\cum sperm sleeping feet .mpg.exe dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1872 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1872 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1872 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1872 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1872 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1872 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1872 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1872 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1872 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1872 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1872 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1872 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1872 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1872 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 1052 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2956 wrote to memory of 1132 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 85 PID 2956 wrote to memory of 1132 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 85 PID 2956 wrote to memory of 1132 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 85 PID 1132 wrote to memory of 1052 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 86 PID 1132 wrote to memory of 1052 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 86 PID 1132 wrote to memory of 1052 1132 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 86 PID 2956 wrote to memory of 1872 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 87 PID 2956 wrote to memory of 1872 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 87 PID 2956 wrote to memory of 1872 2956 dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe"C:\Users\Admin\AppData\Local\Temp\dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe"C:\Users\Admin\AppData\Local\Temp\dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe"C:\Users\Admin\AppData\Local\Temp\dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052
-
-
-
C:\Users\Admin\AppData\Local\Temp\dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe"C:\Users\Admin\AppData\Local\Temp\dfdce39be05c7bd1a5c96aa03ffd90e58badef930482ac2e37c91ce17900f572.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\japanese cumshot sperm catfight .zip.exe
Filesize1.6MB
MD56bec970743efcb009ffaca519285f26a
SHA19b859c12b10ae2a54d67b6eee1c1160be051b3cf
SHA2560ac5ba3087118c3af96285893a58ef1aced3bc0df6f1e340f4e4a9e8b3e91e2e
SHA512b0cb735a5597f11c6dc44b59ed431af73b27be245589abe9aca741b75b551afafd76bc4e64a83f745e97aa38341c412ad474563dc80000f6ee1b3f8507bf75e9