Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 20:46
Static task
static1
Behavioral task
behavioral1
Sample
2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe
Resource
win10v2004-20240709-en
General
-
Target
2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe
-
Size
1.0MB
-
MD5
e553cc6505679275fbcca0e4f1a73e91
-
SHA1
862999b23d86bf602a0692f2407cdc97e7e97381
-
SHA256
2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a
-
SHA512
f3afe7e78b796d23e0123c941013a78ff3ba34b5149ccb587e9725434cafe84cc275afaba1ccaa0beabdb56304ff63b3f6a39399b15fc9b27fcf8d8819abe0cd
-
SSDEEP
24576:86SEl5bHLmBnPaAWaRzN1VfD74drcLtFfYC:5BnLuaaRZ1lP4drS
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\E: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\V: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\Y: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\J: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\O: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\Q: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\R: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\S: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\U: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\Z: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\K: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\L: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\N: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\T: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\W: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\B: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\G: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\H: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\I: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\M: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\P: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File opened (read-only) \??\X: 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\sperm girls balls .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\gay catfight glans .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\SysWOW64\FxsTmp\brasilian horse sperm licking cock .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\SysWOW64\IME\SHARED\danish nude lingerie lesbian (Sylvia).mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\black handjob beast sleeping .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\System32\DriverStore\Temp\lesbian sleeping 50+ (Jenna,Liz).avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\SysWOW64\FxsTmp\nude blowjob uncut feet beautyfull .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\SysWOW64\IME\SHARED\bukkake uncut hole redhair .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\brasilian porn trambling [milf] shower .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\SysWOW64\config\systemprofile\trambling voyeur hairy .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\american nude lesbian masturbation penetration .rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\SysWOW64\config\systemprofile\lingerie [free] feet femdom .rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe -
Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\tyrkish porn beast several models feet ejaculation (Sylvia).avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\japanese fetish beast sleeping hole girly .rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\danish action fucking several models hole circumcision .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\sperm big hole 40+ .zip.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\japanese fetish blowjob lesbian circumcision .rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\bukkake hidden 50+ .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files\Common Files\microsoft shared\tyrkish horse sperm full movie black hairunshaved .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files\dotnet\shared\japanese cum blowjob sleeping .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files\Microsoft Office\root\Templates\sperm sleeping hotel (Sonja,Karin).rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\indian nude hardcore girls mature .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\hardcore girls blondie .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\fucking licking titts 40+ .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files (x86)\Google\Update\Download\sperm licking hole hotel .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\tyrkish cum beast catfight black hairunshaved .zip.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files\Microsoft Office\Updates\Download\brasilian animal gay catfight latex .rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\russian action lesbian licking upskirt .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Program Files (x86)\Google\Temp\tyrkish gang bang trambling big circumcision .rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\trambling big redhair .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\handjob sperm uncut titts mistress .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\indian handjob fucking hot (!) hole sm (Sarah).mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\black kicking lesbian girls sweet (Anniston,Melissa).mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\kicking beast uncut .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\cum hardcore [milf] fishy (Anniston,Curtney).mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\african gay [bangbus] glans .zip.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\bukkake sleeping cock pregnant .rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\cum hardcore licking (Tatjana).mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_c049dbdb4e15bdd2\norwegian hardcore sleeping black hairunshaved .rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\german lingerie voyeur swallow (Ashley,Curtney).mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\kicking fucking full movie feet .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\animal bukkake masturbation cock granny .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\swedish handjob sperm [free] hole fishy .zip.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\american cum horse sleeping glans stockings (Tatjana).avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\american handjob lesbian hidden hole pregnant (Liz).avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\british lingerie uncut feet bedroom .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\russian porn trambling public .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\assembly\tmp\black animal bukkake licking (Jade).avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\asian beast masturbation boots .rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\canadian bukkake [free] (Jade).zip.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\spanish gay voyeur femdom .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\Downloaded Program Files\bukkake public swallow .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\gang bang xxx licking feet swallow .rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\cumshot beast public hole .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\chinese beast sleeping glans swallow .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\chinese bukkake girls granny .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\french xxx full movie mature .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\asian hardcore masturbation high heels .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\trambling hidden glans beautyfull .zip.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\russian fetish blowjob licking .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\asian blowjob hot (!) feet lady .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\russian gang bang sperm [bangbus] femdom .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\lesbian several models boots .rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\german bukkake licking titts .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\tyrkish cumshot trambling full movie .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\russian cum blowjob [free] hole Ôï (Melissa).rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\trambling sleeping boots (Gina,Liz).mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\fetish sperm hidden shower (Gina,Samantha).rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\african trambling [free] pregnant .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\british blowjob sleeping ash .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\cumshot sperm girls feet .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\action lesbian girls (Liz).zip.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\spanish gay uncut feet mature (Melissa).zip.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\chinese fucking several models feet bedroom .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f8d34ba1b1eb00de\italian porn hardcore public feet (Sandy,Jade).mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\danish animal fucking full movie titts .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\german gay girls .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\german lingerie [free] titts .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\beast big black hairunshaved (Sonja,Liz).mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_d980e9752d51efac\gang bang fucking full movie high heels (Jenna,Karin).mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\action bukkake [free] girly .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\norwegian xxx sleeping glans femdom .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\african horse full movie glans ash .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\trambling [free] glans shoes .mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\italian beastiality gay public latex .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\chinese blowjob voyeur hairy .zip.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\tyrkish fetish lesbian lesbian ash (Gina,Melissa).mpg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\german xxx full movie Ôï (Ashley,Karin).avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\CbsTemp\indian cumshot hardcore full movie feet girly .zip.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\xxx public sweet .mpeg.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\spanish lingerie [bangbus] feet .avi.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\trambling lesbian titts .rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\chinese horse sleeping feet Ôï (Janette).rar.exe 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1780 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1780 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1780 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1780 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1780 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1780 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1780 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1780 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1780 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1780 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1780 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1780 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1780 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1780 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 1640 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3180 wrote to memory of 2300 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 86 PID 3180 wrote to memory of 2300 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 86 PID 3180 wrote to memory of 2300 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 86 PID 3180 wrote to memory of 1640 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 87 PID 3180 wrote to memory of 1640 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 87 PID 3180 wrote to memory of 1640 3180 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 87 PID 2300 wrote to memory of 1780 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 88 PID 2300 wrote to memory of 1780 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 88 PID 2300 wrote to memory of 1780 2300 2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe"C:\Users\Admin\AppData\Local\Temp\2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe"C:\Users\Admin\AppData\Local\Temp\2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe"C:\Users\Admin\AppData\Local\Temp\2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1780
-
-
-
C:\Users\Admin\AppData\Local\Temp\2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe"C:\Users\Admin\AppData\Local\Temp\2ee2265368abec9986adbcd64a59b1abe9c40683803f617b0ed6a2852cf0dc9a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\japanese fetish beast sleeping hole girly .rar.exe
Filesize1.5MB
MD540180c4c455a192618da92ea58da002b
SHA1e70e0fba1d70c5a5bdf54e285ba71bb9af035928
SHA25668b3096c7c9d83ac196a7362245a3134d4b4d1fac2528c4d2776deaa6e488236
SHA512348dae1ee34d3fb9b4e4518b151b1977acee331aa7dc3c5a85caaf1223daf8c51be75f08dc179317236053ee063a3d7819ef2dff2cacd5f254ac802d7c45799d