Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 20:58
Behavioral task
behavioral1
Sample
411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe
Resource
win10v2004-20240611-en
General
-
Target
411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe
-
Size
1.8MB
-
MD5
9e310bedb2289c203bc76dad55a1a3ec
-
SHA1
0513eb8d10b4ed344e886f5494a30dcf25c7b534
-
SHA256
411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43
-
SHA512
ccd8dec84c43fd4782e43b12a057e01c0e05f761a6b6eb24f1785069c1cd16a90fd05d8519079d0a75839d16b57b62997f897da7be96c60ef3fd1dfb12962adf
-
SSDEEP
49152:DGlG51HkQN7v6gxNnAxUxwkfTsycJtBXnFqTvXabpdFMmAF+a:a6Eovsx3G43RXn4TWF9AF+a
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4328-0-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/files/0x0007000000023462-5.dat upx behavioral2/memory/2544-18-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2740-143-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4328-186-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2544-188-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2740-189-0x0000000000400000-0x0000000000456000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\R: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\V: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\W: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\U: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\E: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\L: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\N: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\O: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\P: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\Q: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\S: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\I: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\J: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\X: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\Y: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\Z: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\B: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\G: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\H: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\K: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\M: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File opened (read-only) \??\T: 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\indian horse lingerie full movie (Karin).rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\swedish fetish trambling several models .mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\SysWOW64\config\systemprofile\indian fetish horse licking hole young .mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\japanese animal sperm [free] pregnant .mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\italian porn trambling masturbation feet ejaculation .zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\SysWOW64\config\systemprofile\sperm several models feet .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\System32\DriverStore\Temp\danish nude xxx hidden (Curtney).avi.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\SysWOW64\FxsTmp\canadian horse big YEâPSè& (Britney,Curtney).mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\SysWOW64\IME\SHARED\kicking trambling voyeur glans femdom (Curtney).mpeg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\russian cumshot hardcore [milf] .mpeg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\SysWOW64\FxsTmp\lingerie hidden sm .zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\SysWOW64\IME\SHARED\american animal lingerie voyeur glans (Sonja,Melissa).mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\trambling big titts mistress (Sarah).zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files (x86)\Microsoft\Temp\brasilian gang bang bukkake [free] (Sarah).mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files\dotnet\shared\trambling several models hole (Sandy,Samantha).zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\russian cum blowjob sleeping high heels .zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\hardcore licking .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\indian fetish beast voyeur hotel .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files (x86)\Google\Update\Download\danish beastiality blowjob [bangbus] castration .avi.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\horse catfight redhair .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\blowjob hot (!) cock .zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\italian horse lesbian voyeur (Sylvia).avi.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files\Common Files\microsoft shared\tyrkish handjob trambling hot (!) .mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files\Microsoft Office\root\Templates\italian horse hardcore public feet beautyfull (Sylvia).zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\russian cum sperm uncut .mpeg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\bukkake hidden ash .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files\Microsoft Office\Updates\Download\japanese animal lingerie uncut (Tatjana).avi.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\american cum bukkake full movie .zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\russian fetish lesbian [free] .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Program Files (x86)\Google\Temp\russian gang bang hardcore sleeping titts fishy .mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_a4327320c19e2fa7\french lingerie public hole .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\swedish beastiality beast voyeur hole castration (Karin).mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\german beast licking redhair .zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\japanese handjob gay several models hole leather (Liz).avi.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\swedish fetish blowjob licking feet wifey (Sarah).rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\malaysia hardcore uncut titts YEâPSè& (Jade).avi.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\tyrkish gang bang blowjob [free] feet boots .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\beast full movie cock .mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\beastiality lesbian masturbation circumcision .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\canadian hardcore voyeur glans lady .mpeg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\handjob blowjob lesbian bondage .mpeg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\indian cumshot lingerie hidden glans .mpeg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\british trambling [milf] shoes .avi.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\nude fucking girls glans .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_e2f5ebbcec2d8fca\handjob lesbian masturbation pregnant .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\fucking uncut feet traffic (Sarah).zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\cum fucking masturbation feet (Sandy,Tatjana).zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\norwegian hardcore lesbian glans traffic .zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\african lingerie big .mpeg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\trambling girls glans lady (Sarah).zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\asian xxx [free] cock bedroom (Karin).rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\fetish lingerie masturbation .zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\assembly\temp\fucking [bangbus] cock YEâPSè& (Sarah).mpeg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\SoftwareDistribution\Download\lingerie several models (Curtney).zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\PLA\Templates\black animal lesbian lesbian penetration .zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\canadian sperm big .zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\porn lesbian hidden 50+ .avi.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\malaysia blowjob voyeur .avi.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\brasilian kicking gay public .zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\malaysia bukkake public titts circumcision .mpeg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\american handjob trambling [milf] cock wifey (Jade).mpeg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\indian gang bang bukkake catfight castration .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\american horse beast hot (!) (Janette).mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\german hardcore catfight lady .mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\horse [milf] leather (Ashley,Samantha).zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\cum lesbian hidden (Curtney).mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\beastiality gay [bangbus] traffic .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\mssrv.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\beastiality horse hidden glans femdom (Jade).zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\norwegian hardcore public castration (Ashley,Sylvia).mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\german bukkake several models pregnant .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\norwegian blowjob big (Tatjana).mpeg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\Temp\beastiality xxx uncut 50+ .mpeg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\bukkake lesbian 50+ .mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\tyrkish gang bang lesbian girls hole .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\german blowjob licking .mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\hardcore [milf] penetration .avi.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\gay catfight feet .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\animal lesbian [milf] glans girly .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\german sperm [bangbus] .zip.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\spanish xxx several models titts redhair (Melissa).mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\beastiality gay [milf] .avi.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\african gay [milf] latex .mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\InputMethod\SHARED\tyrkish horse bukkake hidden titts ejaculation (Sarah).avi.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\russian animal fucking big cock .avi.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\german horse public titts high heels .mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\danish cum blowjob lesbian 40+ .rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\lingerie catfight hole .mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\german gay masturbation titts 40+ (Karin).mpg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\french fucking [bangbus] (Samantha).rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\gang bang fucking [free] glans (Gina,Karin).rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\bukkake full movie titts (Kathrin,Karin).rar.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\cum sperm public balls .mpeg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\hardcore hidden feet circumcision .mpeg.exe 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 2740 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4328 wrote to memory of 2544 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 86 PID 4328 wrote to memory of 2544 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 86 PID 4328 wrote to memory of 2544 4328 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 86 PID 2544 wrote to memory of 2740 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 91 PID 2544 wrote to memory of 2740 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 91 PID 2544 wrote to memory of 2740 2544 411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe"C:\Users\Admin\AppData\Local\Temp\411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe"C:\Users\Admin\AppData\Local\Temp\411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe"C:\Users\Admin\AppData\Local\Temp\411f877c71de2bf4718b68510fc92d8c5b0a8b1dd145b54ccb6dbf2518ed9b43.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2740
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\russian cum blowjob sleeping high heels .zip.exe
Filesize965KB
MD55dd5ec8a1b0b8f64fd65c6fc1a98ead3
SHA1101a11cbc6571e14a80ed4af7ed2fc8e7473a739
SHA2565596d21be87e5a4779c9b01000069b4b2abb159118d431671411033a3f70108a
SHA512b89a378aef615f86d33fada51b86dd94b996f13d1b84d22b3cf8023896c133b841b5d478c60bd8d4e1783d733f4b126805c14f72f07f21034f1b0ce8478ae8cb