Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 21:54
Behavioral task
behavioral1
Sample
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe
Resource
win10v2004-20240508-en
General
-
Target
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe
-
Size
91KB
-
MD5
4b5d6d18cda1866b0f43584ad800e853
-
SHA1
61d9f0de03e415853d000f20a5f4df5d485e5b9f
-
SHA256
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0
-
SHA512
d83282a47f507275af5e89c39914d5b66c81c2346f7a7968ffa91dcf80f64e7a2ef7ea34eb6e3d5220d7f3fbf9a7652ddda899a54dc1e43097f71a1be889dacb
-
SSDEEP
1536:xRVCaKgzbLc54hukfgvYnouy8gbQHKo4NV1Ayj4m/QWR/Rlq88vlnRqPR/1+qZdq:bjbLl/gvQoutgbqKo4L1Tj4mYWR/R4nv
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4692-44-0x0000000000400000-0x0000000000429000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4300-155-0x0000000000400000-0x0000000000429000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2068-156-0x0000000000400000-0x0000000000429000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4552-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\blowjob lesbian masturbation .mpeg.exe UPX behavioral2/memory/4692-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4300-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2068-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4552-0-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\blowjob lesbian masturbation .mpeg.exe upx behavioral2/memory/4692-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-156-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exedescription ioc process File opened (read-only) \??\A: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\R: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\T: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\X: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\I: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\K: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\L: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\M: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\S: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\Z: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\W: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\B: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\G: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\N: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\O: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\U: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\V: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\E: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\H: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\J: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\P: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\Q: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File opened (read-only) \??\Y: 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe -
Drops file in System32 directory 12 IoCs
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exedescription ioc process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\danish fetish cumshot lesbian stockings .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\FxsTmp\fetish nude big 50+ (Sonja,Karin).mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\IME\SHARED\animal cumshot [free] leather .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\canadian fetish [free] balls .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\config\systemprofile\german action sleeping .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\IME\SHARED\nude uncut (Curtney).rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\indian bukkake full movie circumcision (Curtney).rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\config\systemprofile\russian trambling full movie penetration .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\System32\DriverStore\Temp\chinese cumshot catfight .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\fetish lesbian public legs redhair .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\handjob cumshot big ash .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SysWOW64\FxsTmp\sperm blowjob girls nipples (Ashley).mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe -
Drops file in Program Files directory 18 IoCs
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exedescription ioc process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\blowjob lesbian masturbation .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\japanese nude hardcore girls titts (Christine).mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\nude licking .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Google\Temp\swedish fetish sleeping ash .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\swedish horse licking beautyfull .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files\Common Files\microsoft shared\cumshot several models .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files\Microsoft Office\root\Templates\norwegian action lingerie hot (!) mistress .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\black horse bukkake [free] feet .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\xxx lingerie [milf] balls .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Google\Update\Download\brasilian porn blowjob voyeur latex .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files\dotnet\shared\russian beast gang bang voyeur granny (Karin,Sandy).avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\action gay hidden cock sweet .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files\Microsoft Office\Updates\Download\malaysia lingerie animal full movie YEâPSè& .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\nude xxx full movie bedroom .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Microsoft\Temp\nude catfight (Sarah).mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\chinese action catfight (Gina,Sandy).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\horse lesbian .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\cumshot sleeping glans stockings .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe -
Drops file in Windows directory 64 IoCs
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exedescription ioc process File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\black nude lingerie [free] (Gina).avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\handjob fetish sleeping hole .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\animal blowjob hidden bondage .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\lingerie fetish several models castration .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\french fetish gang bang sleeping hairy (Karin).avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\nude lingerie lesbian bondage .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\spanish sperm horse [free] feet redhair .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\sperm porn licking sm (Liz).avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\security\templates\brasilian beast [free] bondage (Liz).mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\trambling sleeping 40+ .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\swedish lingerie porn sleeping hotel (Sonja).mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\cumshot [milf] mature .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\swedish beast catfight vagina .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\canadian porn cumshot girls .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\american animal catfight titts .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\norwegian fucking catfight .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\Downloaded Program Files\brasilian lingerie handjob voyeur mistress .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\gang bang horse [free] granny (Sarah).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\brasilian lingerie action hot (!) .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\african hardcore gay [free] fishy .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\brasilian bukkake uncut fishy .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\kicking lesbian titts latex .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\norwegian cum [free] 50+ .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\xxx lingerie several models pregnant (Karin).rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\french horse kicking several models beautyfull (Tatjana,Janette).mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\german lingerie [milf] titts .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\cum trambling [free] (Ashley).rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.746_none_4cfe603abbcbfd86\lingerie catfight upskirt .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\assembly\tmp\animal uncut boobs hairy .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\nude lesbian nipples young .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\handjob lingerie hidden boobs (Sarah).rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\swedish horse hot (!) boots (Sarah).zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\horse lesbian wifey (Kathrin,Sonja).zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\sperm hidden cock .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\bukkake blowjob full movie fishy .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\american hardcore animal catfight legs gorgeoushorny .zip.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\russian cumshot uncut .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\black xxx lesbian traffic .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\swedish kicking bukkake masturbation black hairunshaved .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\black trambling sperm lesbian shower .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\chinese trambling hot (!) .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\african fetish bukkake [free] hairy .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\mssrv.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\danish cumshot blowjob [free] .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\black hardcore uncut (Melissa,Sonja).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\sperm bukkake voyeur feet (Jade,Melissa).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\japanese beastiality several models girly .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\horse cumshot [free] YEâPSè& .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\black bukkake horse girls .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\beast action girls vagina .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\hardcore full movie hole .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\horse big titts boots (Sonja,Jade).rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\danish bukkake sleeping boots .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\american trambling animal [milf] latex .rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\american sperm catfight titts wifey .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\french kicking horse lesbian swallow (Anniston,Karin).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\russian trambling gay hidden .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\fucking uncut hole penetration (Sandy,Sandy).mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\bukkake hardcore hidden glans (Sandy).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\chinese gang bang kicking uncut bedroom (Sonja).rar.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\japanese bukkake cumshot hidden nipples fishy .avi.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.1_none_813610a8a9b59e0a\tyrkish hardcore horse girls penetration .mpeg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\sperm sperm full movie pregnant (Sylvia).mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\british hardcore [milf] swallow .mpg.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exepid process 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2068 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2068 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2068 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2068 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2068 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2068 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2068 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2068 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2068 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2068 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2068 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2068 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2068 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 2068 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 4300 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exedescription pid process target process PID 4552 wrote to memory of 4692 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 4552 wrote to memory of 4692 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 4552 wrote to memory of 4692 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 4552 wrote to memory of 4300 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 4552 wrote to memory of 4300 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 4552 wrote to memory of 4300 4552 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 4692 wrote to memory of 2068 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 4692 wrote to memory of 2068 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe PID 4692 wrote to memory of 2068 4692 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe 55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"C:\Users\Admin\AppData\Local\Temp\55202bfaa42897f8a91765600f3b15ff222a8382ccada754a65a6880f34c80f0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\blowjob lesbian masturbation .mpeg.exeFilesize
509KB
MD5b06dcd7a4dd61afd29c840df704bd96c
SHA173d4f8097a88887f8f7dd53c6f8f15bd7c352369
SHA256006bb8c79df6a83fe385ae9d0fc087fe11ed3f90eedf1f88c6c45ae5eb828671
SHA5127016d312edf75beffb1f7c1b4f5bf6cd6ae6da05cc8171511cd7635a0d85cd856a061cdd05b9378dfa9db70ce9077c4b1625ff04eba8a768bd1b5fa53aa48fa8
-
memory/2068-156-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4300-155-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4552-0-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4692-44-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB