Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 17:51
Behavioral task
behavioral1
Sample
4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe
-
Size
1.7MB
-
MD5
4ea9534b56697202c026ac4bd85eb690
-
SHA1
0bc62bb2883c66e3d3189bd62c7b1ff58c432719
-
SHA256
b9c1e002158f5c39b8057507c27438c96c813bf6f919846ac00ab711105a9133
-
SHA512
f1d9c0e62cc4fe1f6ea0425cc5ddfc7300fe2d956fba5d5519bbce22eca1fed8111789aaeb2b9ab3c1a3855796bde8d8f248aa1549eff06885f9f61a39071c9a
-
SSDEEP
24576:A8vtTau+cM42rUymcpXJOYpqFz57sGe1QPhpjxsggyIS9J3fx0Ep0hOBQEg8:AktGu+hTQaOsqMQJdNgU9J3fYIBQEl
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/2692-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x000a000000023b98-5.dat upx behavioral2/memory/2448-54-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/6120-159-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4944-158-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-185-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2448-186-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4944-187-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/6120-188-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-190-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-192-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-197-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-207-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-211-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-216-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-220-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-224-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-228-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-232-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-236-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-240-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-244-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2692-248-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\R: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\U: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\W: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\A: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\B: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\K: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\M: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\T: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\Z: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\H: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\L: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\Q: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\S: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\V: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\X: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\E: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\G: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\I: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\J: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\N: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\O: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File opened (read-only) \??\Y: 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\SHARED\tyrkish porn xxx [bangbus] cock penetration .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\swedish kicking lingerie masturbation (Sylvia).zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\xxx [free] hotel (Sandy,Janette).zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\SysWOW64\config\systemprofile\japanese animal lesbian several models balls .mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\SysWOW64\FxsTmp\swedish cumshot hardcore voyeur .zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\SysWOW64\config\systemprofile\blowjob catfight hole .mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\SysWOW64\FxsTmp\animal sperm licking (Jade).rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\horse girls (Melissa).zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\danish fetish horse voyeur cock girly (Melissa).avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\lingerie several models redhair .zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\System32\DriverStore\Temp\black handjob xxx catfight glans 40+ .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\lesbian voyeur sweet .mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\indian cumshot horse [bangbus] 50+ .zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\danish horse horse [milf] beautyfull (Ashley,Jade).mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\tyrkish porn horse sleeping 50+ .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\indian kicking bukkake [free] feet .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\japanese animal lesbian [milf] glans .mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files\dotnet\shared\swedish horse blowjob sleeping .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\lingerie big (Jade).mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\tyrkish beastiality horse lesbian titts .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\american kicking lingerie [free] gorgeoushorny .mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\japanese horse horse voyeur titts .mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files\Microsoft Office\root\Templates\tyrkish action fucking [milf] leather .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\american animal fucking [milf] feet 50+ (Samantha).zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\xxx [bangbus] bedroom .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files (x86)\Google\Temp\japanese cum trambling full movie redhair (Kathrin,Curtney).zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files (x86)\Google\Update\Download\brasilian handjob xxx public hairy .mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files\Microsoft Office\Updates\Download\brasilian cum bukkake [free] (Liz).mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\swedish beastiality sperm licking girly .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Program Files (x86)\Microsoft\Temp\swedish beastiality xxx girls granny .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\russian action beast masturbation glans (Christine,Karin).mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\InputMethod\SHARED\tyrkish horse fucking hidden high heels .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\italian horse xxx uncut upskirt .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\french trambling hidden .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\tyrkish horse lingerie masturbation cock (Sonja,Tatjana).zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\american horse sperm licking cock beautyfull (Liz).mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\horse girls cock .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\german horse catfight .mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\kicking fucking sleeping hole .mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\blowjob voyeur pregnant .zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\swedish action beast sleeping titts .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\italian fetish bukkake licking .mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\swedish cumshot beast masturbation feet Ôï (Sarah).mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\french xxx full movie bedroom .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\beastiality xxx [bangbus] stockings .mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\british lesbian masturbation cock .mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\Downloaded Program Files\xxx big .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\nude horse licking .mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\spanish xxx [bangbus] feet gorgeoushorny .zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\spanish sperm masturbation feet swallow .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\PLA\Templates\lingerie lesbian YEâPSè& .mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\african fucking hidden .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\gay big hole femdom .mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\norwegian sperm public Ôï .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\action bukkake full movie glans .mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f8d34ba1b1eb00de\blowjob uncut circumcision .mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\fetish fucking hidden feet upskirt .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\spanish bukkake sleeping cock beautyfull .mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\fucking masturbation cock .mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\lingerie uncut feet .zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\american porn beast uncut (Janette).mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\nude blowjob sleeping mature .zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\blowjob [free] .mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\french lesbian girls .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\porn lesbian sleeping boots .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\CbsTemp\lesbian licking latex (Sonja,Sarah).rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\japanese horse xxx uncut .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\danish handjob lesbian [bangbus] hole girly (Jade).zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\InstallTemp\malaysia trambling big glans beautyfull .mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\gay public ash .mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\african xxx voyeur .mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\porn sperm licking cock swallow .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\swedish kicking trambling full movie (Liz).mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\x86_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_231ddfc33015c6db\japanese kicking fucking sleeping .mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\asian blowjob several models glans .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\french hardcore sleeping .mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\african sperm [bangbus] glans sm (Sarah).rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\black cumshot sperm hidden .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\russian porn trambling sleeping glans ¤ç .mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\asian trambling full movie .zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\chinese gay licking YEâPSè& (Gina,Sarah).mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\lesbian catfight hole 50+ .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\trambling [free] mature .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\tyrkish cum beast [free] wifey (Christine,Karin).rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\action beast sleeping balls .zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\action horse [milf] girly .mpeg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\animal trambling [free] (Tatjana).mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\indian nude hardcore voyeur traffic .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\nude bukkake voyeur young .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\sperm hidden titts young (Jade).zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\xxx licking (Liz).mpg.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\Temp\indian fetish horse big (Janette).zip.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\indian animal blowjob masturbation sm .rar.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_4ab14109a3e1e067\chinese blowjob [bangbus] cock mature .avi.exe 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 4944 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 4944 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 4944 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 4944 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 4944 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 4944 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 4944 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 4944 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 4944 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 4944 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 4944 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 4944 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 4944 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 4944 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 6120 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2448 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 87 PID 2692 wrote to memory of 2448 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 87 PID 2692 wrote to memory of 2448 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 87 PID 2692 wrote to memory of 4944 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 88 PID 2692 wrote to memory of 4944 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 88 PID 2692 wrote to memory of 4944 2692 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 88 PID 2448 wrote to memory of 6120 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 89 PID 2448 wrote to memory of 6120 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 89 PID 2448 wrote to memory of 6120 2448 4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:6120
-
-
-
C:\Users\Admin\AppData\Local\Temp\4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ea9534b56697202c026ac4bd85eb690.jaffacakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\lingerie big (Jade).mpg.exe
Filesize2.0MB
MD51419a498befc67da5bffd83195670c1f
SHA15fc95bfab2441d01434b0ad305ebdbee73d10461
SHA256ce86106bf5ad82bee808bd5ee53f196fa4c2955da49dbcdf2ee18eaf1d9a4fc0
SHA5127431c8585fc8a9817420cdfb521d84d495aab138f76ada65de40978758e3a6f77137c5268db5f127bfaccba4293a27b229b42d3d41d4ab6f2935e5e071acf76b