Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe
Resource
win10v2004-20240508-en
General
-
Target
4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe
-
Size
1.9MB
-
MD5
09163db2ddd9d400120ac101b3992e59
-
SHA1
81ac3d73099dc577813be677b3c2c6b80c1c0697
-
SHA256
4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4
-
SHA512
81950b40694f4eda93d0b318678f4e1495957e541b1305741005bffbfa510cbabe00ece487169488838e0d748db0084825286a1da7c90ca49d6f8c22cdb9dcee
-
SSDEEP
49152:Vw6N9zglIdGffsqKse/kVrZ5b82gEl4Cwp7:q6/zglwGfk0Vl5IzIDwp7
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\K: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\R: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\W: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\Z: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\N: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\O: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\Q: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\Y: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\E: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\L: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\M: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\P: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\S: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\T: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\A: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\B: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\H: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\I: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\J: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\U: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\V: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File opened (read-only) \??\X: 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\System32\LogFiles\Fax\Incoming\lingerie licking hotel .mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\swedish animal fucking hot (!) .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\SysWOW64\FxsTmp\russian cum gay licking balls (Britney,Melissa).mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\american kicking gay voyeur feet girly (Tatjana).zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\american beastiality gay sleeping cock hotel .rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\SysWOW64\config\systemprofile\italian horse sperm uncut hotel (Ashley,Melissa).mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\System32\DriverStore\Temp\swedish kicking lingerie sleeping .mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\SysWOW64\FxsTmp\canadian lingerie sleeping .mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\SysWOW64\IME\SHARED\bukkake sleeping 50+ (Kathrin,Sarah).avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\brasilian cum lesbian [bangbus] glans ejaculation .mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\SysWOW64\config\systemprofile\japanese kicking bukkake full movie titts (Sonja,Tatjana).rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\SysWOW64\IME\SHARED\japanese cumshot gay full movie bedroom .mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe -
Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\american animal lingerie several models 50+ .mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\sperm big glans girly .rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\italian cum lingerie [bangbus] cock (Gina,Melissa).rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\swedish cumshot xxx [milf] cock (Jenna,Liz).mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\american cum xxx [milf] glans swallow .rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files\Microsoft Office\root\Templates\brasilian fetish lesbian girls cock black hairunshaved .rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\bukkake lesbian (Sarah).rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files (x86)\Google\Temp\black gang bang horse several models glans traffic .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\japanese cum sperm full movie titts upskirt .avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files\dotnet\shared\brasilian cumshot gay big hairy .mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\indian fetish trambling voyeur cock .avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files\Microsoft Office\Updates\Download\danish animal bukkake [milf] hole .rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\danish gang bang beast masturbation shoes (Gina,Melissa).rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\handjob lingerie [free] titts YEâPSè& (Karin).mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\bukkake full movie stockings (Gina,Samantha).mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\nude trambling hidden fishy .mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Program Files (x86)\Google\Update\Download\hardcore voyeur black hairunshaved .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\african hardcore [bangbus] hole young (Melissa).avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\gang bang lesbian [milf] (Liz).zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\nude fucking [milf] feet 40+ (Liz).avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\german bukkake hidden (Sarah).rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_c049dbdb4e15bdd2\beastiality sperm voyeur glans .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\gang bang gay uncut glans .avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\black cum bukkake masturbation feet .rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\chinese trambling hot (!) femdom .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\indian cum lingerie hot (!) stockings .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\handjob bukkake voyeur blondie .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\danish nude gay girls swallow .avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\swedish animal horse public (Janette).avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\african bukkake licking wifey .rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\indian handjob horse uncut hole (Jenna,Tatjana).mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\PLA\Templates\black beastiality lesbian big (Sarah).avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\lingerie full movie .avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\fetish bukkake catfight cock bedroom .avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\brasilian handjob trambling voyeur 50+ .mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\russian fetish horse public stockings .avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\fucking sleeping hole (Britney,Janette).rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\beast [bangbus] shower .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\russian kicking horse uncut .mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\kicking horse hot (!) beautyfull (Kathrin,Sylvia).rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\japanese animal sperm hidden (Sarah).rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\nude blowjob full movie hole upskirt .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_72a319bf8ee74a9b\indian action trambling full movie titts .rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\fucking big YEâPSè& .mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\InputMethod\SHARED\black cum lingerie girls feet beautyfull .rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\beast masturbation hole Ôï .mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\malaysia blowjob hidden girly .mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\animal gay [free] leather .avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\japanese gang bang gay full movie swallow (Britney,Curtney).mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\cum blowjob sleeping (Curtney).mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\porn lesbian big ejaculation .mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\horse beast girls bedroom (Sonja,Janette).zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\black animal bukkake voyeur shoes (Britney,Janette).avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\russian beastiality bukkake [milf] traffic .avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\german beast big .mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\nude xxx masturbation traffic .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\horse hardcore several models feet .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\blowjob [milf] cock young .mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\beast girls shower .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\american fetish bukkake [bangbus] girly (Anniston,Sylvia).mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\brasilian cumshot fucking public .mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\black cum lesbian several models .avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_93c5f32b7859ec4f\handjob blowjob big cock .mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\blowjob full movie black hairunshaved .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\lingerie full movie .avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\kicking trambling uncut ash .rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\african lingerie hidden titts .rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\italian fetish bukkake big glans .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\horse lesbian [free] hole bedroom (Samantha).mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\nude beast licking 50+ .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\lesbian sleeping (Melissa).mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\german beast lesbian titts .mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\horse sperm voyeur hairy .avi.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\russian animal lesbian [milf] (Tatjana).mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\animal gay public .rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\action horse girls hole fishy (Janette).zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\porn horse big glans balls .mpeg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\tyrkish porn lesbian voyeur .mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\italian gang bang trambling [bangbus] femdom .mpg.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\danish nude hardcore [bangbus] swallow (Christine,Melissa).rar.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\lesbian sleeping feet blondie .zip.exe 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 976 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 976 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 976 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 976 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 976 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 976 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 976 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 976 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 976 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 976 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 976 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 976 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 976 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 976 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 1608 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4912 wrote to memory of 3364 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 80 PID 4912 wrote to memory of 3364 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 80 PID 4912 wrote to memory of 3364 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 80 PID 4912 wrote to memory of 1608 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 81 PID 4912 wrote to memory of 1608 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 81 PID 4912 wrote to memory of 1608 4912 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 81 PID 3364 wrote to memory of 976 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 82 PID 3364 wrote to memory of 976 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 82 PID 3364 wrote to memory of 976 3364 4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe"C:\Users\Admin\AppData\Local\Temp\4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe"C:\Users\Admin\AppData\Local\Temp\4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe"C:\Users\Admin\AppData\Local\Temp\4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:976
-
-
-
C:\Users\Admin\AppData\Local\Temp\4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe"C:\Users\Admin\AppData\Local\Temp\4fa117c817b547df1f762639c7998a4f4fa860fe9905da93358d2ce12850e5b4.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\sperm big glans girly .rar.exe
Filesize1.1MB
MD5e76dec951878aa382c7cee5b3477f17a
SHA11401a7e6fb4ac56451889a7785b1fab649db2b00
SHA256efc7143fb1d85d4ea3a32e21d3200b79101069696644c6d138d5607ea8da4602
SHA512f32d9381c9651625d6c4b8f8b65de8574fcd75eb02221b7edc58c48aba02105d533dc92a2f763dbb0c2c1d75b15e83a06c0c2d94286a5f48a7aaa146fda2b951
-
Filesize
146B
MD5cf8dcbebd5a6f5c744b6f7b58a395ba2
SHA118b37bbaa4d77b64f299c1288ab2c7e56a4eac3b
SHA256921d55ccbbd08c92ee34f8e65baa9d3cdea19a00507ace35053adf7f3dbd72eb
SHA5121793bd3f58ad2f71d2fabe07ffe8f8055d1c6cb5116d06152355d047acf8f0473af075b7cafe3bd99d652935e0bee82e2ec0392aa872f338a835017799f0e475