Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 03:53
Static task
static1
Behavioral task
behavioral1
Sample
e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe
Resource
win10v2004-20240508-en
General
-
Target
e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe
-
Size
1.8MB
-
MD5
78a458ccbc0651a782743e9fd7a6b818
-
SHA1
ba096600ea73f801322facd634d3d48de5b5a5c4
-
SHA256
e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe
-
SHA512
da8797254b57cc18ef6956205aa8bc84c8079e14438ef9a030d6ccc08c52c48540d4c886500cdd3a27e4e2f5dfcad9218a23d84864fca421744523e218581d5a
-
SSDEEP
49152:hcSdq+181leKataGiLD2y2zNmIn0Ef24W2V4tXSBrokssavz01qrt0SUYv7k:GSd3183ebwXCy2zNmI0EmtYokstv4
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
Processes:
resource yara_rule C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\tyrkish horse beast big titts traffic .mpg.exe INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exee4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exedescription ioc process File opened (read-only) \??\G: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\O: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\U: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\W: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\I: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\J: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\K: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\M: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\S: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\Z: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\Q: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\R: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\A: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\B: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\H: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\L: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\N: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\P: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\Y: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\E: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\T: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\V: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File opened (read-only) \??\X: e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe -
Drops file in System32 directory 12 IoCs
Processes:
e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exedescription ioc process File created C:\Windows\SysWOW64\FxsTmp\swedish kicking horse full movie YEâPSè& .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\SysWOW64\IME\SHARED\blowjob [free] (Jade).rar.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\xxx uncut .avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\swedish porn xxx several models feet mature .rar.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\danish handjob fucking [bangbus] .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\SysWOW64\FxsTmp\horse full movie titts .avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\SysWOW64\IME\SHARED\trambling [milf] (Liz).mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\System32\DriverStore\Temp\sperm [free] fishy .rar.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\bukkake [bangbus] titts castration (Liz).mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\SysWOW64\config\systemprofile\american fetish bukkake catfight .rar.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\brasilian porn trambling girls glans .rar.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\SysWOW64\config\systemprofile\japanese kicking xxx lesbian hole (Gina,Liz).avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe -
Drops file in Program Files directory 18 IoCs
Processes:
e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Templates\japanese action xxx hidden bondage .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\black kicking gay hot (!) hole gorgeoushorny .avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\indian cum xxx girls 50+ .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files\dotnet\shared\gay voyeur girly .zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\black beastiality lingerie catfight titts black hairunshaved .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\japanese cum lingerie masturbation ash .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\italian cumshot lesbian hidden feet .avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files (x86)\Google\Temp\brasilian cumshot fucking [milf] .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files\Common Files\microsoft shared\sperm masturbation .rar.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\russian handjob blowjob masturbation cock latex .zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\chinese beast big swallow .zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\tyrkish horse beast big titts traffic .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files\Microsoft Office\Updates\Download\black animal gay lesbian .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\italian porn sperm [bangbus] .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\xxx voyeur young (Kathrin,Tatjana).zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files (x86)\Google\Update\Download\japanese porn bukkake full movie cock .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files (x86)\Microsoft\Temp\gay [milf] castration .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\gay licking hole upskirt .avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe -
Drops file in Windows directory 64 IoCs
Processes:
e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exedescription ioc process File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\fetish beast big glans upskirt (Sylvia).mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\lesbian sleeping feet .rar.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\chinese xxx uncut feet penetration .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\spanish beast sleeping glans hotel .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\horse lingerie hot (!) YEâPSè& .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\black horse xxx voyeur penetration .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\fetish trambling licking .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\beast big (Samantha).avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\kicking horse public traffic (Sonja,Melissa).mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\handjob sperm lesbian feet femdom (Sylvia).mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\sperm hidden glans bedroom (Sylvia).zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\norwegian blowjob several models cock blondie (Melissa).avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\lingerie licking bondage .rar.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\cumshot trambling licking circumcision .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\action lingerie big femdom (Jenna,Sylvia).zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\spanish sperm big .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\InputMethod\SHARED\lesbian [bangbus] (Tatjana).zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\security\templates\japanese porn fucking full movie cock swallow (Melissa).mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\tyrkish beastiality gay big cock young .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\indian gang bang xxx big glans ejaculation .zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\american gang bang sperm [milf] feet (Sandy,Jade).avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\black handjob trambling girls pregnant (Kathrin,Janette).avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\Temp\sperm big glans bondage .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\lingerie [milf] shoes .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\brasilian animal hardcore hot (!) bondage .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\lesbian hidden (Curtney).zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\black beastiality lesbian big upskirt .avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\bukkake uncut feet .zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\xxx big titts ¤ç (Melissa).avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\trambling hot (!) (Sylvia).zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\hardcore uncut circumcision .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\InstallTemp\african sperm catfight young .avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\cumshot hardcore big black hairunshaved .zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\nude blowjob voyeur hole ash (Jade).mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\xxx several models .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\danish horse hardcore catfight black hairunshaved (Christine,Liz).mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\action fucking girls bondage .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\russian gang bang sperm full movie titts sweet .zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\tyrkish beastiality lesbian hidden feet boots (Karin).avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\beast catfight leather .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\american horse beast [bangbus] pregnant .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\porn sperm [free] (Jade).mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\kicking lesbian licking glans blondie .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\american handjob bukkake full movie glans .rar.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\lingerie masturbation cock (Anniston,Tatjana).mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\horse beast full movie 50+ .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\hardcore uncut .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\tyrkish fetish horse full movie cock .zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\CbsTemp\tyrkish action horse public titts mistress (Sarah).rar.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\chinese horse catfight lady .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\beastiality sperm lesbian feet .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\chinese xxx uncut balls .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\Downloaded Program Files\trambling catfight lady .zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\japanese kicking bukkake lesbian stockings .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\italian porn sperm big .zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\animal hardcore lesbian feet fishy .rar.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\asian trambling several models hotel .zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\french gay masturbation hairy (Kathrin,Liz).zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\cumshot xxx sleeping (Melissa).mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\swedish animal xxx lesbian cock gorgeoushorny (Janette).avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\japanese handjob bukkake several models glans .mpeg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\indian gang bang trambling masturbation glans .mpg.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\german gay lesbian 40+ .avi.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\horse hardcore big feet .zip.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exee4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exee4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exepid process 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 552 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exee4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exedescription pid process target process PID 760 wrote to memory of 3744 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe PID 760 wrote to memory of 3744 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe PID 760 wrote to memory of 3744 760 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe PID 3744 wrote to memory of 552 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe PID 3744 wrote to memory of 552 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe PID 3744 wrote to memory of 552 3744 e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe"C:\Users\Admin\AppData\Local\Temp\e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe"C:\Users\Admin\AppData\Local\Temp\e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe"C:\Users\Admin\AppData\Local\Temp\e4ecd879c96b0189b31622025ce714105e0c890341efe97cbc8ebdabe2de1afe.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\tyrkish horse beast big titts traffic .mpg.exeFilesize
116KB
MD578f082a0c8b201d4a71cdd43affe5ad0
SHA18cffd1f3054b971609a228a0774211d78461270d
SHA256c4387a47a6d7153dfcbeaaf2081006e8bf12a22607d8ccd1f48779845847878c
SHA512e9eb6c1a7729ddd5a62857f66a9d3ec6bfc45d58984d0a2f068123ffe63c2d8f63167182d986208eec8d82bcab7b5d8082dd29a6ed8dfb682c7978baeaf63c26