Analysis
-
max time kernel
174s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 16:44
Static task
static1
Behavioral task
behavioral1
Sample
e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe
-
Size
386KB
-
MD5
522ffcd4c2ad7fbc859fc7721d4238f4
-
SHA1
ee5ab18f97587f67d38504fd698bf1a27b71dbf7
-
SHA256
e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e
-
SHA512
025bc8d0c2cb037fe7dadb5641ce10cfaa82083243074a18619c6dc5ba67eb19f4269f9e1d8841c1f7456226ba335ad6ee8fcbf34a4dad9e2ba80578866244a5
-
SSDEEP
12288:zXCNi9BMd9VUPyb3Pzcq2YLBZ9TcJIcVyo9bnhg:2W+9VZLP1rLBZ9TGIiy2bhg
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\F: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\M: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\P: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\U: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\A: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\K: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\Z: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\W: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\Y: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\J: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\Q: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\R: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\S: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\T: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\N: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\O: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\V: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\B: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\G: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\H: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\I: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\L: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File opened (read-only) \??\X: e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\SHARED\cumshot action several models (Liz,Samantha).zip.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\System32\DriverStore\Temp\xxx [bangbus] .rar.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\tyrkish porn cumshot hot (!) blondie (Tatjana).mpeg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\cumshot lesbian .zip.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\black lesbian masturbation 40+ .mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SysWOW64\FxsTmp\norwegian fetish blowjob uncut glans lady .zip.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\russian fucking sperm hidden (Liz,Melissa).zip.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\british horse big sm (Janette,Liz).mpeg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SysWOW64\config\systemprofile\japanese animal masturbation circumcision .mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SysWOW64\FxsTmp\italian cumshot public stockings (Jade,Kathrin).zip.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SysWOW64\IME\SHARED\french xxx horse voyeur hole latex .zip.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SysWOW64\config\systemprofile\malaysia lingerie licking legs .zip.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe -
Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\russian nude hot (!) blondie .rar.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\beast hot (!) legs (Sonja).mpeg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files (x86)\Google\Update\Download\japanese animal [milf] beautyfull .zip.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\canadian bukkake nude catfight glans .mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files\Common Files\microsoft shared\italian beast licking cock .rar.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\brasilian beastiality lingerie [bangbus] swallow .mpeg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\fetish cum girls mistress (Sarah,Tatjana).avi.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files (x86)\Google\Temp\animal beastiality full movie (Tatjana,Liz).mpeg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files (x86)\Microsoft\Temp\cum beast catfight .rar.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\norwegian cumshot xxx several models (Sarah,Jade).mpeg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\italian nude blowjob catfight (Jenna,Christine).mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files\Microsoft Office\root\Templates\canadian action horse several models .mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\blowjob girls 40+ .zip.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\nude horse several models cock .avi.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files\Microsoft Office\Updates\Download\porn porn hidden ¼ë .avi.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\spanish beast porn [bangbus] beautyfull .avi.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\indian horse [free] titts .mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe -
Drops file in Windows directory 28 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\canadian gay masturbation YEâPSè& (Sandy,Sandy).rar.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\malaysia beast lesbian public ash hotel (Sandy,Sonja).mpeg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\british cum public ash .mpeg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\Downloaded Program Files\handjob lesbian voyeur high heels .rar.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\tyrkish lesbian voyeur traffic .rar.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\horse [bangbus] high heels (Britney).zip.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\xxx hot (!) boots .avi.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\mssrv.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\PLA\Templates\spanish horse lesbian hole (Gina,Curtney).rar.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\spanish animal sleeping hole hotel (Curtney,Christine).rar.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\gang bang kicking hidden fishy .avi.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\assembly\temp\french gang bang masturbation .mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\security\templates\hardcore sperm several models .avi.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\InputMethod\SHARED\american gay [bangbus] titts .mpeg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\spanish horse masturbation .mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\CbsTemp\italian kicking porn full movie shoes .mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\russian animal fucking lesbian (Kathrin).zip.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\sperm [free] .zip.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SoftwareDistribution\Download\japanese gay several models vagina balls .zip.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\african bukkake hardcore uncut girly (Sandy,Samantha).mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\american bukkake kicking full movie shoes .mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\brasilian beastiality licking .mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\indian animal hot (!) blondie .avi.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\assembly\tmp\french porn lesbian [free] YEâPSè& .rar.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\kicking sleeping .mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\canadian blowjob girls YEâPSè& (Gina,Kathrin).rar.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\chinese beast big ¼ë .mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\cum fetish voyeur pregnant .mpg.exe e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 3456 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 3456 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 3456 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 3456 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 3456 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 3456 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 3456 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 3456 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 3456 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 3456 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 3456 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 3456 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 3456 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 3456 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 4348 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2236 wrote to memory of 5108 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 83 PID 2236 wrote to memory of 5108 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 83 PID 2236 wrote to memory of 5108 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 83 PID 5108 wrote to memory of 4348 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 85 PID 5108 wrote to memory of 4348 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 85 PID 5108 wrote to memory of 4348 5108 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 85 PID 2236 wrote to memory of 3456 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 84 PID 2236 wrote to memory of 3456 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 84 PID 2236 wrote to memory of 3456 2236 e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe"C:\Users\Admin\AppData\Local\Temp\e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe"C:\Users\Admin\AppData\Local\Temp\e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe"C:\Users\Admin\AppData\Local\Temp\e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348
-
-
-
C:\Users\Admin\AppData\Local\Temp\e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe"C:\Users\Admin\AppData\Local\Temp\e92e06818e3246205fb46c9e9c8a008c57885eec1a0786af712ab86ebf16be4e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3456
-