Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 02:51
Static task
static1
Behavioral task
behavioral1
Sample
cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe
Resource
win10v2004-20240508-en
General
-
Target
cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe
-
Size
756KB
-
MD5
e32d2d072fda33166930996dc2a43420
-
SHA1
6fe1ecd953a8194d92c3f1b0864a23eae45e4b2a
-
SHA256
cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6
-
SHA512
ca1833840db692f747ae3d840c1c842964c619af0db27206d4bd7e9ce1821bb3bde437d6e2046af11e2e780c3475250fdd5d2a1c01f28efd6b14fdef212e0523
-
SSDEEP
12288:A//vi9B32pewJgj832UaMjNtYvWpKjaZZB+N7jvp76jWYu1uVgbqt/ctYvtf6Hp+:2wCv3HaMBtLpK6mdt76vVg+JctYIl4xr
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
Processes:
resource yara_rule C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\japanese kicking blowjob several models .zip.exe INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.execda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exedescription ioc process File opened (read-only) \??\B: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\L: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\N: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\O: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\S: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\W: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\Z: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\E: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\I: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\M: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\R: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\T: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\U: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\V: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\Y: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\J: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\Q: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\A: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\G: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\H: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\K: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\P: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File opened (read-only) \??\X: cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe -
Drops file in System32 directory 12 IoCs
Processes:
cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exedescription ioc process File created C:\Windows\SysWOW64\IME\SHARED\swedish animal masturbation boobs stockings .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\asian hardcore hidden black hairunshaved .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\lesbian masturbation penetration .zip.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\SysWOW64\config\systemprofile\brasilian bukkake bukkake big (Anniston,Ashley).zip.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\SysWOW64\FxsTmp\beastiality gang bang [milf] sweet (Anniston).avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\SysWOW64\IME\SHARED\norwegian sperm kicking uncut ash .rar.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\spanish beast several models hairy .mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\SysWOW64\FxsTmp\handjob action [bangbus] .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\System32\DriverStore\Temp\black animal voyeur boobs .mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\british fetish action voyeur beautyfull .mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\hardcore sperm licking high heels .mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\SysWOW64\config\systemprofile\asian gang bang cum several models girly .mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe -
Drops file in Program Files directory 18 IoCs
Processes:
cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\swedish horse lingerie full movie hotel .mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\danish action voyeur hairy (Sarah,Melissa).mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\french handjob action [free] ash ,Ó .mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files (x86)\Google\Temp\hardcore trambling uncut .rar.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\japanese kicking blowjob several models .zip.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\russian trambling kicking licking boobs pregnant (Karin).mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\norwegian handjob horse hidden ejaculation .rar.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\brasilian cumshot lesbian voyeur boots .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files\dotnet\shared\tyrkish cum uncut cock .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files\Microsoft Office\root\Templates\swedish xxx voyeur girly (Anniston,Karin).mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\lingerie horse lesbian young .rar.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\action nude hot (!) .mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files\Microsoft Office\Updates\Download\action several models ejaculation .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\tyrkish porn girls boobs mistress .mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files (x86)\Google\Update\Download\trambling big (Jenna,Tatjana).mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\danish blowjob animal lesbian penetration .rar.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files (x86)\Microsoft\Temp\black xxx cumshot public ash .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\tyrkish fucking fucking masturbation .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe -
Drops file in Windows directory 64 IoCs
Processes:
cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exedescription ioc process File created C:\Windows\assembly\temp\tyrkish handjob gang bang girls glans granny .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\Downloaded Program Files\swedish horse big feet hairy .rar.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\sperm blowjob girls sm (Christine,Kathrin).mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\action hot (!) YEâPSè& (Tatjana).zip.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\norwegian hardcore hidden 50+ .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\bukkake licking balls .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\danish trambling voyeur glans girly .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\trambling beast big hole traffic .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\PLA\Templates\lingerie handjob hidden ejaculation .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\indian xxx nude full movie ejaculation (Anniston,Sylvia).zip.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\black beast fetish [milf] ash .zip.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\french gang bang lingerie uncut feet Ôï .rar.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\animal blowjob girls bedroom (Sarah,Sarah).zip.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\porn voyeur .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\chinese trambling sleeping fishy .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\norwegian beast gang bang hot (!) black hairunshaved .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\chinese fucking fucking licking hairy .zip.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\lesbian public fishy .zip.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\gang bang horse [bangbus] .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\danish nude beastiality catfight .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\russian lingerie hardcore masturbation vagina .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\tyrkish hardcore lesbian fishy .rar.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\horse public latex .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\french porn porn catfight traffic (Sonja).mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\horse horse full movie gorgeoushorny .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\norwegian handjob public penetration (Christine).mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\horse catfight titts latex (Sylvia,Sylvia).mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\african sperm bukkake public hotel (Tatjana).mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\canadian cumshot horse girls lady .mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\horse hidden (Sandy).rar.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_it-it_1a80ce63d483fe70\italian fucking uncut hole .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\malaysia lingerie hidden blondie .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\swedish fetish kicking licking cock black hairunshaved .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\japanese beast [bangbus] pregnant (Janette).mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\canadian kicking [bangbus] .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\indian action handjob [bangbus] (Curtney,Sandy).avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\russian horse public beautyfull (Anniston).avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\security\templates\asian kicking [milf] lady .rar.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\spanish nude sleeping .rar.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\animal several models .mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\norwegian trambling cumshot catfight latex .zip.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_e2f5ebbcec2d8fca\blowjob cum catfight titts (Samantha,Sarah).mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\danish sperm kicking [bangbus] sm .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\blowjob gay [bangbus] (Jenna).mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\spanish beast [free] ejaculation .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\trambling [milf] lady (Sylvia).mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\canadian cum nude masturbation (Sylvia,Gina).mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\german animal uncut pregnant .zip.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\beastiality [bangbus] .rar.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\norwegian beastiality uncut (Jenna,Sonja).mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\german fetish sleeping .zip.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\beast sleeping sweet (Christine,Melissa).mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\asian horse nude several models .zip.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\horse gay sleeping black hairunshaved (Sylvia,Anniston).mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\japanese fucking [milf] .mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\swedish kicking fucking [milf] .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\african kicking sleeping .zip.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\japanese xxx voyeur (Sarah,Sarah).mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\black sperm cum lesbian shower (Jade,Melissa).mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\french fetish gang bang sleeping gorgeoushorny .mpg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\canadian horse trambling masturbation .rar.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\blowjob xxx girls .avi.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\handjob blowjob lesbian hotel .mpeg.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\british gang bang big leather (Jade).rar.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.execda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.execda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.execda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exepid process 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1080 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1080 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1080 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1080 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1080 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1080 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1080 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1080 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1080 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1080 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1080 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1080 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1080 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1080 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe 576 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.execda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exedescription pid process target process PID 1256 wrote to memory of 4952 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe PID 1256 wrote to memory of 4952 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe PID 1256 wrote to memory of 4952 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe PID 1256 wrote to memory of 576 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe PID 1256 wrote to memory of 576 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe PID 1256 wrote to memory of 576 1256 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe PID 4952 wrote to memory of 1080 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe PID 4952 wrote to memory of 1080 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe PID 4952 wrote to memory of 1080 4952 cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe"C:\Users\Admin\AppData\Local\Temp\cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe"C:\Users\Admin\AppData\Local\Temp\cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe"C:\Users\Admin\AppData\Local\Temp\cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe"C:\Users\Admin\AppData\Local\Temp\cda5836b6fed840baf84ba54ed27a3451d1a278b0babf58a7c715be8e56ebce6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\japanese kicking blowjob several models .zip.exeFilesize
768KB
MD587c9d7e1b35f0f44a35dcef670d2b991
SHA129e90a2246440a1c7a9c94c7e07928a98a6eddd4
SHA256ae1afcc3a432558d269ddfb3c43f6ff14f35e50d0aeab3570868bd797f42db58
SHA5129a4bf94cf19c2fdab819feee39f259d551137aae69aa44b3290b573e881bc3058b614e3f0a89bf2e7c5bfedc965f962acbebaf78dc648d63d8a992bfe1659fb6
-
C:\debug.txtFilesize
146B
MD5913cc5e3783a9a00e7febaea2c10155f
SHA140732692100406ab42ca344cf1578651904e949f
SHA256d3ee059b123f9d9765645eb1678380b3a624f4988dc16cd34b333ea804911a10
SHA5124d84d377729871487d7f203f95fd6f8777d46bd3fd03a0f41341be19c2860de44ffd0713a01f1269858da9d107d26cd3e57051c6020f7b9a3c6054eb75924e16