Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 18:56
Static task
static1
Behavioral task
behavioral1
Sample
15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe
Resource
win10v2004-20240508-en
General
-
Target
15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe
-
Size
1.6MB
-
MD5
27e91c1da2c0bf01709f06de9609a0f2
-
SHA1
b20d34a6b43395dfdaf709b331098604aadf4e23
-
SHA256
15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623
-
SHA512
43038607fd3cc5425cd5a5f3af42a6d4e6849f4aa57877cd20bd05065d3fcb980bd0c541580b99b89f3112bae7a52bcaa12a5776fa5ef70376fa80a9c96c1009
-
SSDEEP
24576:Q4ww2HobIdkuyXrL4UeqTg6n/KZYcH5vEpmawEbmFu7+UE22XPMxorVqFB//mRe:QVwMocmuyv4CkwcH5v9aIF40JUCMFx5
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023417-4.dat INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\I: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\K: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\N: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\W: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\A: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\L: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\Q: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\R: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\S: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\X: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\E: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\H: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\M: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\O: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\U: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\Z: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\G: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\J: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\P: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\T: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\V: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File opened (read-only) \??\Y: 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\horse animal public (Ashley).mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\SysWOW64\config\systemprofile\british beastiality cum public beautyfull .mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\tyrkish cum [milf] .mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\System32\DriverStore\Temp\bukkake lingerie lesbian ash (Ashley,Christine).rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\SysWOW64\FxsTmp\british blowjob uncut hairy .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\indian beast [free] stockings .mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\SysWOW64\FxsTmp\lesbian fucking uncut boobs wifey .rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\SysWOW64\IME\SHARED\italian fucking blowjob catfight ash .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\canadian horse hot (!) .mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\SysWOW64\config\systemprofile\british handjob cum uncut (Melissa,Gina).zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\SysWOW64\IME\SHARED\japanese gang bang [milf] nipples .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\norwegian xxx bukkake catfight .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\fetish big .mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files (x86)\Microsoft\Temp\black animal [free] vagina gorgeoushorny .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\british porn sperm [bangbus] glans fishy .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files\dotnet\shared\brasilian xxx full movie (Melissa).mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files\Microsoft Office\root\Templates\italian handjob [bangbus] titts black hairunshaved .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\black bukkake hardcore girls beautyfull .mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files\Microsoft Office\Updates\Download\japanese gay horse big .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\beastiality kicking [bangbus] girly .mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\african handjob horse licking .mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files (x86)\Google\Update\Download\indian action big beautyfull .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\black bukkake beastiality [free] .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\french fetish hidden gorgeoushorny (Karin).mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files (x86)\Google\Temp\swedish porn hidden .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files\Common Files\microsoft shared\handjob girls upskirt .rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\swedish beast public .rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\horse bukkake [milf] .rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\african cum blowjob sleeping black hairunshaved .mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\african porn fucking licking .mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\blowjob fetish [milf] ash latex .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\tyrkish nude gang bang hot (!) .mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\nude girls (Anniston,Sarah).rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\sperm xxx [milf] .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_c049dbdb4e15bdd2\cum lesbian sweet .rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\chinese beast gang bang catfight bondage .mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\kicking voyeur vagina (Curtney,Gina).zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\fucking sperm masturbation .rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\hardcore masturbation glans bondage .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\PLA\Templates\animal lingerie licking feet boots .mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\gang bang beast hot (!) (Curtney).zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\xxx fucking lesbian 50+ (Sarah).mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataoraclec.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_3b8d4dacc2ea6b71\russian trambling beast masturbation titts .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\african action lesbian full movie redhair (Jenna,Jenna).avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\norwegian animal beastiality hot (!) YEâPSè& .mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\assembly\tmp\british sperm fetish public vagina 50+ (Jenna).rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\french animal hardcore girls girly .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\tyrkish fucking girls castration .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\french gay gang bang big .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_d980e9752d51efac\norwegian nude catfight legs young .mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\hardcore uncut legs boots .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_e2f5ebbcec2d8fca\malaysia xxx beastiality several models mature .mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\french action cum [free] .mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\kicking lesbian public .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\russian kicking blowjob catfight hairy .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\horse public (Christine,Karin).rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\sperm voyeur nipples traffic (Jenna,Tatjana).zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\russian horse [milf] hole black hairunshaved .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\gang bang lesbian hidden YEâPSè& .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\american blowjob hidden fishy (Sonja,Jade).mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\asian handjob fucking licking circumcision .rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\xxx cum public ash .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\sperm several models (Anniston).avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\cumshot cumshot big latex .rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\chinese cum several models hotel .mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\african gang bang hardcore girls cock hairy .mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\animal sleeping high heels .rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\american horse [bangbus] latex (Janette,Melissa).mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\italian handjob xxx masturbation mistress .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\german hardcore hot (!) glans (Sandy,Anniston).mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\british cum horse voyeur .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\black horse xxx hot (!) castration .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\fucking kicking public 40+ .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\beast hot (!) traffic .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\british porn hidden upskirt .rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\porn uncut titts hotel .mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\danish sperm beastiality lesbian high heels .mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\malaysia fetish full movie .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\mssrv.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\african cum full movie femdom .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\american cumshot bukkake public .mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\tyrkish action sleeping (Anniston,Sonja).mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\swedish fetish handjob masturbation hairy .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\cumshot handjob uncut (Anniston).mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\gay full movie (Sonja,Sandy).avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\asian beast blowjob hot (!) high heels .zip.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\black trambling [bangbus] cock leather .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\french cum hidden feet (Janette,Liz).avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\german porn hardcore hot (!) granny .mpeg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\bukkake cum sleeping cock .rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_72a319bf8ee74a9b\canadian animal voyeur glans traffic .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\hardcore several models .rar.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\porn uncut wifey .avi.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\canadian kicking lesbian several models wifey .mpg.exe 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2380 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2380 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2380 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2380 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2380 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2380 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2380 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2380 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2380 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2380 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2380 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2380 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2380 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2380 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 2520 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1428 wrote to memory of 32 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 81 PID 1428 wrote to memory of 32 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 81 PID 1428 wrote to memory of 32 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 81 PID 32 wrote to memory of 2520 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 86 PID 32 wrote to memory of 2520 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 86 PID 32 wrote to memory of 2520 32 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 86 PID 1428 wrote to memory of 2380 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 87 PID 1428 wrote to memory of 2380 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 87 PID 1428 wrote to memory of 2380 1428 15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe"C:\Users\Admin\AppData\Local\Temp\15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe"C:\Users\Admin\AppData\Local\Temp\15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe"C:\Users\Admin\AppData\Local\Temp\15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2520
-
-
-
C:\Users\Admin\AppData\Local\Temp\15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe"C:\Users\Admin\AppData\Local\Temp\15b97ff1e3988e692a262de3a1bc35116aece92e0692ffe600a50a28aa630623.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\black bukkake hardcore girls beautyfull .mpeg.exe
Filesize1.1MB
MD53627479d8f1285799216d6e78cd48732
SHA1f8ddb4a1b013db83c502c362595ab1dbd01f1b7e
SHA2569b411b946a654af7d3f1ca6641616658eac83d6db51f01cf64ed0ba6069275bb
SHA512f0870824ad821a16b5a8cc3a053f71281be2e828141716f6b389752e598877a438e33e6a586117d40cc067b45e0d118d0e2a4a6b7f94abde99b79ce2d874463f