Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 18:49
Static task
static1
Behavioral task
behavioral1
Sample
0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe
Resource
win10v2004-20240226-en
General
-
Target
0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe
-
Size
804KB
-
MD5
9e600574e58791e87e87aed3630e6fc6
-
SHA1
eb2e0195f015ba8b9a0569060bf6663e9f2e8642
-
SHA256
0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0
-
SHA512
336e7bd8cc21c233869f2efb36936be3c384ac84ddbb137ebe10ba4c14dec03c81a723e40de69129087627c8ef3ed6751dd8eb9c0435b58891b0bc83595e6e71
-
SSDEEP
12288:oGHasii9BmPQH4WIe/Z5hHRslBsqodvutsKP8jnY2rrOsOXwq1e3+j6uCAJHKRc:86tyElWlBQJKUNXTq1eOj7CAJHGc
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023248-4.dat INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\J: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\V: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\X: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\N: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\P: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\R: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\T: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\Y: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\S: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\U: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\W: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\A: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\I: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\K: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\M: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\O: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\Z: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\B: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\G: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\H: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\L: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File opened (read-only) \??\Q: 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\spanish sperm gang bang hidden (Ashley).mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\SysWOW64\config\systemprofile\xxx several models feet .mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\SysWOW64\IME\SHARED\norwegian lesbian uncut legs latex (Ashley).avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\lesbian [free] ash swallow (Melissa,Anniston).zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\malaysia cum nude masturbation (Liz,Liz).mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\SysWOW64\FxsTmp\malaysia horse nude catfight legs upskirt .avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\brasilian lingerie bukkake public legs latex .mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\System32\DriverStore\Temp\lingerie hidden boobs ash .rar.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\SysWOW64\FxsTmp\swedish fucking cum [milf] .mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\italian kicking hardcore voyeur titts (Sarah,Tatjana).mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\SysWOW64\config\systemprofile\russian animal xxx sleeping bondage .rar.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\SysWOW64\IME\SHARED\danish gang bang lesbian sweet .rar.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe -
Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\indian action licking (Samantha).avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\swedish blowjob cumshot public ash .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\german beastiality beast lesbian nipples mistress .mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files\Common Files\microsoft shared\tyrkish hardcore [free] leather .mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian blowjob [free] .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\brasilian handjob gang bang hidden bedroom (Anniston,Sylvia).mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\beastiality full movie hole shower .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\handjob action licking nipples fishy (Liz).zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files (x86)\Google\Update\Download\black beast horse [free] shoes .mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files\dotnet\shared\japanese animal action masturbation boobs hotel (Britney).mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files\Microsoft Office\root\Templates\handjob gang bang [milf] .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files\Microsoft Office\Updates\Download\cumshot [bangbus] vagina black hairunshaved .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\russian beast animal uncut 40+ .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\EDGEMITMP_19EA3.tmp\lingerie beast uncut .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\swedish xxx fucking sleeping mistress .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\german gay blowjob hot (!) .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files (x86)\Google\Temp\danish action hot (!) ash lady .mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files (x86)\Microsoft\Temp\canadian blowjob hidden boots (Karin).avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\hardcore full movie mistress .mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\japanese horse gay hot (!) ejaculation .rar.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\norwegian lesbian action catfight .mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\xxx hardcore catfight gorgeoushorny .avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\sperm sperm catfight young (Ashley,Karin).rar.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\animal sleeping ash (Liz).avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\swedish hardcore gang bang hot (!) .mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\japanese blowjob blowjob hot (!) YEâPSè& .mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\russian animal several models fishy .mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\french fucking horse masturbation YEâPSè& .mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\indian porn action several models pregnant (Karin,Sandy).mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\japanese kicking nude [milf] hole latex .rar.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\black porn cumshot sleeping .rar.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\black cum fucking uncut (Kathrin).mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\black blowjob horse public blondie .avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\asian horse porn public legs (Kathrin,Liz).avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\malaysia fetish animal hidden young .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\assembly\temp\danish horse hot (!) gorgeoushorny .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\gang bang fucking full movie ash shoes (Tatjana).mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\cumshot beastiality lesbian .avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\norwegian lesbian [bangbus] .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\tyrkish xxx big .mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\mssrv.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\assembly\tmp\tyrkish fucking [free] (Samantha,Curtney).avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\action full movie hole 40+ (Sonja,Kathrin).avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\italian xxx big bedroom .avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\african animal hot (!) legs .avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\beast cumshot [free] .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\brasilian porn full movie .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\fucking bukkake girls balls (Liz,Kathrin).rar.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\porn licking boots (Christine).mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\gay masturbation .avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\indian trambling beastiality licking .avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\indian beast handjob big (Gina).zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\brasilian hardcore uncut nipples .rar.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\british lesbian masturbation feet .rar.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\sperm full movie upskirt (Ashley).mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\PLA\Templates\fucking [bangbus] boobs young .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\security\templates\lesbian porn public feet penetration .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\cum [free] bedroom (Karin,Kathrin).rar.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\swedish fetish full movie upskirt .mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\gay [milf] (Samantha).rar.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\kicking licking legs high heels .mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\horse girls legs .avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\InputMethod\SHARED\chinese xxx uncut 50+ .avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\asian beast hardcore big legs sm .mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\malaysia trambling lingerie several models shoes .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\danish handjob action [bangbus] ash .mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\porn beastiality big nipples .mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\CbsTemp\brasilian action lesbian several models (Karin).mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\norwegian sperm lingerie masturbation .rar.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\fucking nude [bangbus] girly .avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\chinese action big feet girly (Liz,Ashley).mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\cum porn hidden YEâPSè& .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\gang bang fetish girls .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\norwegian action catfight .mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\brasilian animal cumshot voyeur sweet .mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\trambling [milf] (Anniston).avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\italian hardcore kicking hidden upskirt .mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\american beastiality cum [free] ash castration .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\cumshot catfight bedroom (Karin).mpeg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\animal catfight glans bondage .mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\horse blowjob masturbation redhair .zip.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\danish cumshot bukkake sleeping boobs (Ashley,Jenna).avi.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\hardcore porn girls hairy .mpg.exe 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2324 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2324 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2324 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2324 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2324 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2324 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2324 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2324 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2324 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2324 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2324 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2324 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2324 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2324 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 3348 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4444 wrote to memory of 2420 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 91 PID 4444 wrote to memory of 2420 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 91 PID 4444 wrote to memory of 2420 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 91 PID 4444 wrote to memory of 3348 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 92 PID 4444 wrote to memory of 3348 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 92 PID 4444 wrote to memory of 3348 4444 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 92 PID 2420 wrote to memory of 2324 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 93 PID 2420 wrote to memory of 2324 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 93 PID 2420 wrote to memory of 2324 2420 0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe"C:\Users\Admin\AppData\Local\Temp\0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe"C:\Users\Admin\AppData\Local\Temp\0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe"C:\Users\Admin\AppData\Local\Temp\0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2324
-
-
-
C:\Users\Admin\AppData\Local\Temp\0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe"C:\Users\Admin\AppData\Local\Temp\0edf110878bad2662402abe1e3e7b7eaee18094a4d870e50b119c9b1ec8c5ef0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3792 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵PID:1012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian blowjob [free] .zip.exe
Filesize1.8MB
MD501aa3605c25f520f128461f3366e11fe
SHA14bfd7fb23d3a311de8028ef0bbcf8ca78130b071
SHA256821afac0844b3b6c9ce2df4c5c49e9e1cd103d922e5873d5ea96fb0dc27d0acd
SHA51281409be02925a67d37aa068c5b99d7cd7569637cba11e24f91aeec7aec0499b277bd63e6419bd555ac056fe3bfac676c2f6cff2857c2e79633a6ed4d7cf986e6