Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 16:48
Behavioral task
behavioral1
Sample
63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe
Resource
win10v2004-20240412-en
General
-
Target
63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe
-
Size
231KB
-
MD5
2818f39135defe87aee238809434b6f7
-
SHA1
d0b1aa1e58367511512cb7824d419b0cafb53c5a
-
SHA256
63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169
-
SHA512
4a9b766e7fe1f80ff3a5d7029a1b7a3c37ea197c0a22e4497521b2fb4a955ca9297e65576f3c4b1199bb44c6f9ca9d666b5b6ad12cb813bf136bc1ed2fbfc885
-
SSDEEP
6144:xjluQoSqIo5R4nM/40yJNaRFhyt5qFbtGijGrs0VxujOq:xEQoS+qhr50tGioscQOq
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 5 IoCs
resource yara_rule behavioral2/memory/4008-26-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3992-187-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4008-191-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2464-194-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4424-195-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral2/memory/3992-0-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/files/0x00070000000233f9-5.dat UPX behavioral2/memory/4008-26-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/2464-151-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/4424-152-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3992-187-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/4008-191-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/2464-194-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/4424-195-0x0000000000400000-0x000000000041D000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3992-0-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/files/0x00070000000233f9-5.dat upx behavioral2/memory/4008-26-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2464-151-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4424-152-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3992-187-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4008-191-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2464-194-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4424-195-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\M: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\R: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\Y: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\P: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\Q: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\T: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\G: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\J: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\L: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\O: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\S: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\U: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\V: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\A: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\E: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\H: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\I: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\K: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\N: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\W: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\X: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File opened (read-only) \??\Z: 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\bukkake lesbian titts shower .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\SysWOW64\config\systemprofile\japanese porn gay licking .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\japanese horse xxx [free] titts lady (Karin).rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\SysWOW64\FxsTmp\bukkake voyeur titts .avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\lingerie uncut titts .mpeg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\russian beastiality bukkake voyeur feet YEâPSè& (Jade).mpeg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\SysWOW64\config\systemprofile\trambling [bangbus] cock (Christine,Liz).avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\SysWOW64\IME\SHARED\russian cum bukkake public feet ash (Melissa).zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\hardcore lesbian boots .mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\System32\DriverStore\Temp\beast hot (!) femdom .mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\SysWOW64\FxsTmp\xxx public .mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\SysWOW64\IME\SHARED\horse girls glans .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\tyrkish horse beast several models sm .avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files\dotnet\shared\danish gang bang gay [milf] cock femdom .avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\trambling several models .mpeg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\bukkake sleeping fishy .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\lingerie licking (Sarah).avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\hardcore girls .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files (x86)\Microsoft\Temp\tyrkish kicking lingerie several models (Sarah).mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files\Common Files\microsoft shared\american animal bukkake full movie hole circumcision .mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files\Microsoft Office\root\Templates\italian beastiality lingerie sleeping feet beautyfull (Samantha).rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\japanese nude gay several models titts young (Curtney).rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files\Microsoft Office\Updates\Download\blowjob [milf] (Samantha).rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files (x86)\Google\Update\Download\indian action xxx full movie (Sarah).mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\russian horse blowjob [free] (Liz).rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\brasilian beastiality lesbian voyeur hole hotel (Melissa).avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\african blowjob big titts .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\sperm uncut blondie .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files (x86)\Google\Temp\italian action beast lesbian upskirt .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\russian fetish lingerie [free] titts shower .avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\russian fetish lingerie [free] cock .avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\animal beast catfight fishy .avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\tyrkish cumshot sperm licking cock redhair (Samantha).avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\blowjob [milf] girly .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\cum hardcore girls .mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\kicking xxx masturbation shower .avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\american fetish blowjob [bangbus] feet hairy .mpeg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\nude xxx masturbation .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\norwegian blowjob hot (!) (Samantha).avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\black porn fucking lesbian castration .avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\swedish gang bang blowjob [bangbus] .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_a4327320c19e2fa7\lesbian voyeur hole .mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\japanese cumshot beast public .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_b201c2e68d8dbc0d\hardcore hidden cock .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\italian cum lesbian sleeping 50+ (Sonja,Melissa).avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\spanish gay sleeping .mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\african lingerie sleeping circumcision (Sonja,Jade).mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\asian fucking public .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\french lingerie [milf] latex (Britney,Curtney).mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\black animal xxx public cock .mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\PLA\Templates\black animal lingerie full movie penetration .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\malaysia trambling licking boots .mpeg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\canadian blowjob full movie gorgeoushorny .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\black horse fucking uncut young .mpeg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.1_none_5a23b464e1e0b15e\kicking beast voyeur gorgeoushorny .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\american handjob beast [milf] titts 50+ (Sarah).mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\gay big penetration .avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\british bukkake voyeur cock leather .mpeg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\spanish horse lesbian blondie (Jenna,Sarah).zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\chinese sperm licking high heels .avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\norwegian lingerie masturbation feet .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\french trambling full movie .avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\american cumshot lesbian [bangbus] feet beautyfull .mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\hardcore full movie wifey .mpeg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\african blowjob girls glans boots (Jade).zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\canadian lingerie licking titts .mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\beastiality gay [free] .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\tyrkish gang bang lesbian licking .mpeg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\mssrv.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\malaysia blowjob voyeur feet .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\horse gay lesbian (Melissa).zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\american handjob beast [milf] glans shoes .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\brasilian cum sperm sleeping .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\american cum sperm masturbation feet beautyfull .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\brasilian kicking bukkake sleeping cock .mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\xxx public .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\african horse uncut cock shoes (Tatjana).rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\swedish horse horse voyeur (Jade).rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\indian fetish blowjob girls .mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\kicking horse [bangbus] (Janette).zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\canadian lesbian voyeur swallow .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\canadian bukkake voyeur ejaculation .mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\russian gang bang sperm public .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\african blowjob [bangbus] shower (Ashley,Karin).mpeg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\lingerie [free] feet .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\brasilian cumshot trambling [free] feet .mpeg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\lingerie several models hole 40+ (Curtney).zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_e2f5ebbcec2d8fca\asian lingerie uncut glans girly .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\brasilian horse horse masturbation feet bedroom .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\brasilian handjob horse public .zip.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\brasilian kicking lingerie public .rar.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\horse [milf] feet .mpg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\black beastiality xxx uncut ash .avi.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe File created C:\Windows\assembly\temp\hardcore voyeur glans swallow (Curtney).mpeg.exe 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4424 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4424 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4424 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4424 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4424 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4424 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4424 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4424 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4424 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4424 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4424 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4424 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4424 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4424 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 2464 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3992 wrote to memory of 4008 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 91 PID 3992 wrote to memory of 4008 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 91 PID 3992 wrote to memory of 4008 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 91 PID 3992 wrote to memory of 2464 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 99 PID 3992 wrote to memory of 2464 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 99 PID 3992 wrote to memory of 2464 3992 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 99 PID 4008 wrote to memory of 4424 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 100 PID 4008 wrote to memory of 4424 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 100 PID 4008 wrote to memory of 4424 4008 63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe"C:\Users\Admin\AppData\Local\Temp\63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe"C:\Users\Admin\AppData\Local\Temp\63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe"C:\Users\Admin\AppData\Local\Temp\63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4424
-
-
-
C:\Users\Admin\AppData\Local\Temp\63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe"C:\Users\Admin\AppData\Local\Temp\63debd5884fe33be596b8b60c6a9d282238a65c6be4c59a88f9041ff33efc169.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\japanese nude gay several models titts young (Curtney).rar.exe
Filesize1.8MB
MD564559578619480053bfac2eca9e9868b
SHA14c7b7f392a4f54b835231b61e609af7e1cc49105
SHA256df2027baa2e4561210efca5a76a22720ec709c30a97c5ba1b9a7840c2e4b6467
SHA512b31a4f5f36a48f2e30c5dd8a0e776b37beb5b246a3e8a4f169356745473e4b63768ab5223586d4f3a22ceecc745ddcaf6293453ab01a5119fb40efea1c161861