Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 23:08
Static task
static1
Behavioral task
behavioral1
Sample
764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe
Resource
win10v2004-20240412-en
General
-
Target
764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe
-
Size
1.3MB
-
MD5
2a7569c1013557fae464ba06843adbd3
-
SHA1
5f603f000c09dafc83d44bbcbee49613e1755579
-
SHA256
764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3
-
SHA512
62f30e5de0b3eda20854b4a8aa722a98547ce9d83609fe82fbe1caf2945cf5aae84ef23d9762587bf7eaae8413a9ec5b3656b7fb2d88b6c1bff5235e7f79753f
-
SSDEEP
24576:86VrxsUNSP22KmSVvaOBoPAO5/z56xKxl8MVoZvGcwN3:5Vl3SP2GgvaOBoPAO5/z55xl/Jt9
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
Processes:
resource yara_rule C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\fucking animal hot (!) (Sarah).avi.exe INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exedescription ioc process File opened (read-only) \??\H: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\J: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\K: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\M: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\P: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\S: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\U: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\L: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\X: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\B: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\I: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\N: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\O: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\Q: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\V: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\W: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\A: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\E: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\G: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\R: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\T: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\Y: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File opened (read-only) \??\Z: 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe -
Drops file in System32 directory 12 IoCs
Processes:
764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exedescription ioc process File created C:\Windows\SysWOW64\FxsTmp\trambling fetish uncut .mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\malaysia bukkake hot (!) (Ashley,Melissa).mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\gang bang bukkake public .avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\SysWOW64\config\systemprofile\german porn sleeping swallow .avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\russian kicking [milf] YEâPSè& (Anniston).avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\kicking horse hidden hole balls (Curtney).mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\SysWOW64\config\systemprofile\horse lesbian hidden .rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\System32\DriverStore\Temp\fucking lingerie [milf] (Britney).rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\SysWOW64\IME\SHARED\american fetish hidden boots .mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\american bukkake full movie boobs upskirt .rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\SysWOW64\FxsTmp\nude [free] .avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\SysWOW64\IME\SHARED\porn girls feet .mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe -
Drops file in Program Files directory 18 IoCs
Processes:
764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exedescription ioc process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\fucking animal hot (!) (Sarah).avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files\Microsoft Office\Updates\Download\brasilian nude [bangbus] glans .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\chinese action action sleeping vagina penetration .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files\Common Files\microsoft shared\fetish lingerie public feet .rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files\dotnet\shared\american beastiality voyeur titts gorgeoushorny (Samantha,Ashley).mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files (x86)\Google\Temp\french porn voyeur legs fishy .mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files (x86)\Microsoft\Temp\african fetish fucking [bangbus] mistress .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\canadian animal [bangbus] .avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\norwegian cumshot full movie .rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\lingerie public vagina upskirt (Sandy,Christine).mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files (x86)\Google\Update\Download\black lesbian hidden wifey .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\french fucking porn catfight granny (Britney,Gina).avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\american blowjob several models nipples sweet .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\brasilian fetish sperm [milf] glans upskirt .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\asian cum masturbation upskirt (Jade,Christine).avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\gay hot (!) .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files\Microsoft Office\root\Templates\beastiality handjob hidden redhair (Melissa).zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\american fucking sleeping YEâPSè& .zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe -
Drops file in Windows directory 64 IoCs
Processes:
764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\french porn uncut hole 40+ .avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\spanish blowjob cumshot [milf] cock .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\chinese handjob girls Ôï .avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\nude cumshot lesbian legs .zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\spanish fetish licking blondie (Sonja).avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\british horse animal full movie .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\brasilian action cumshot uncut shoes (Anniston).avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\german bukkake beast [free] (Janette).mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\african trambling horse lesbian girly (Sarah).zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\russian hardcore full movie .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\black gang bang horse voyeur shower .mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\assembly\tmp\swedish blowjob fucking sleeping .mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\lesbian beast catfight fishy .zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\indian cum animal voyeur bondage (Sarah).mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\indian gay gang bang hidden hole young .rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\porn porn big (Sonja).rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\chinese trambling fucking licking fishy .avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\sperm several models upskirt .rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\danish animal voyeur latex .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\indian blowjob [bangbus] mistress (Anniston).mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\InstallTemp\canadian hardcore [bangbus] .zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\hardcore hidden boots (Gina).rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\beast catfight ash bedroom (Kathrin).mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\handjob voyeur legs black hairunshaved .rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\bukkake kicking public feet hotel .rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\fucking handjob several models .zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\bukkake beast several models latex .mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\CbsTemp\xxx voyeur .avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\black kicking public ash .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\cumshot big (Britney).zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\porn xxx voyeur .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\spanish trambling sleeping .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\norwegian blowjob animal big .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\italian handjob animal full movie .zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\black blowjob lesbian girls .zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\black horse [milf] bondage (Janette,Tatjana).rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\Downloaded Program Files\french cumshot horse catfight young .zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\british horse cumshot girls legs YEâPSè& .avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\xxx masturbation legs .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\canadian porn bukkake [free] .zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\swedish cum voyeur (Sarah,Melissa).avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\sperm nude hot (!) traffic .mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\action blowjob voyeur lady (Tatjana,Sandy).rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\cum several models (Liz).mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\assembly\temp\animal catfight ash .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\danish xxx catfight bedroom .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\indian kicking uncut hotel .rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\security\templates\spanish lesbian masturbation penetration .zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\horse public .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\asian horse blowjob [bangbus] .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\gang bang hidden mistress .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\animal voyeur (Liz).rar.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\brasilian fucking cumshot catfight .avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\american action action hidden .mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\italian action lingerie licking feet beautyfull (Liz,Janette).mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\lingerie gang bang big (Kathrin).mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\action [free] hole ash .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\trambling xxx girls .mpeg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bca64d70c79f104b\lingerie gang bang full movie sm (Anniston,Karin).zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\tyrkish fetish girls legs young (Melissa).zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\trambling xxx uncut glans .zip.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\sperm horse uncut traffic .mpg.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\swedish bukkake beastiality [milf] .avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\italian fucking public .avi.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exepid process 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 2284 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exedescription pid process target process PID 916 wrote to memory of 2888 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe PID 916 wrote to memory of 2888 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe PID 916 wrote to memory of 2888 916 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe PID 2888 wrote to memory of 2284 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe PID 2888 wrote to memory of 2284 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe PID 2888 wrote to memory of 2284 2888 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe 764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe"C:\Users\Admin\AppData\Local\Temp\764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe"C:\Users\Admin\AppData\Local\Temp\764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe"C:\Users\Admin\AppData\Local\Temp\764b35310a72bb0109e7507e1ab1a1164ecfd20664a97b05c0d504b3f5bb1ec3.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\fucking animal hot (!) (Sarah).avi.exeFilesize
1.1MB
MD5c9c27a2e77eb0e2f4655f3cfab2a11e8
SHA1aecd253d9c6c8a7f062dae718575980c9630acbc
SHA256b344199d08ea34a2f7a4ae2e907e4ececed0b5d807f1c9b4731f34dda3c12db1
SHA512a3e9445b12e4738b9a083efa7e103811a813ddc204314f57cc7b937189053a7e06b708f730a2fe0ee9001c910349585e922d8ebda3fda6a6c72c8f3002392b88