Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 21:40
Behavioral task
behavioral1
Sample
6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe
Resource
win10v2004-20240226-en
General
-
Target
6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe
-
Size
790KB
-
MD5
b3a044246f59c3f5efb6aa4e40152506
-
SHA1
8976be8951f691e3a9e2e5112a4c9b6e40e0b4d4
-
SHA256
6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e
-
SHA512
4084cfffc61bb8cd86f3c9a9589bc9936ff5bf66c72884b4199113f2006980edf5d6612df0ea441e73a388ca20cd0b7dca32e24a146548b0db7bf4fbcb6ad4f8
-
SSDEEP
12288:VEQoSfqvoM6/+n8kN8Eh1sF9ELRPU/hz7fYe1gFz45z0GRlHa9Z8WFQYZ93zsZ37:V0t6W8q/FNU/9jYetAGRpaBFQo93gZL
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 17 IoCs
resource yara_rule behavioral1/memory/2956-9-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-87-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-89-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-90-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-91-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-96-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-109-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-112-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-115-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-118-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-121-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-126-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-129-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-132-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-135-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-138-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2480-141-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral1/memory/2480-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/files/0x0007000000016bf1-5.dat UPX behavioral1/memory/2956-9-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-53-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-87-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-89-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-90-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-91-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-96-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-109-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-112-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-115-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-118-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-121-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-126-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-129-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-132-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-135-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-138-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2480-141-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2480-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/files/0x0007000000016bf1-5.dat upx behavioral1/memory/2956-9-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-53-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-87-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-89-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-90-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-91-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-96-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-109-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-112-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-115-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-118-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-121-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-126-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-129-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-132-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-135-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-138-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2480-141-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\O: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\Q: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\S: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\T: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\U: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\V: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\E: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\X: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\W: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\B: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\N: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\P: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\R: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\A: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\I: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\J: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\L: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\H: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\K: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\Y: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\Z: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File opened (read-only) \??\G: 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\russian fetish lesbian full movie glans YEâPSè& (Samantha).avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\SysWOW64\IME\shared\italian animal sperm voyeur glans .mpeg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lingerie [bangbus] cock redhair .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\SysWOW64\FxsTmp\lesbian girls sweet .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\fucking uncut (Karin).zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\SysWOW64\FxsTmp\nude trambling catfight glans .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\japanese fetish fucking public YEâPSè& .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\SysWOW64\config\systemprofile\fucking catfight glans (Sandy,Melissa).avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\SysWOW64\IME\shared\japanese gang bang lingerie licking feet .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\SysWOW64\config\systemprofile\russian animal lingerie public upskirt .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\gay uncut leather .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\indian cumshot lesbian licking .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\gay full movie (Janette).mpeg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Program Files (x86)\Microsoft Office\Templates\swedish porn blowjob hidden YEâPSè& .rar.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Program Files (x86)\Google\Update\Download\swedish gang bang beast licking titts stockings .mpg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Program Files\DVD Maker\Shared\black cumshot bukkake girls glans (Christine,Melissa).avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\xxx full movie cock .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\fucking [milf] glans hotel (Liz).mpg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Program Files\Windows Journal\Templates\xxx several models titts upskirt .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\indian animal fucking [free] .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\swedish nude beast hidden redhair .mpeg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Program Files (x86)\Google\Temp\indian nude xxx sleeping bedroom (Gina,Karin).mpg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\hardcore several models circumcision .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\russian kicking gay voyeur (Samantha).mpeg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\indian fetish lingerie licking hotel .mpeg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SoftwareDistribution\Download\italian action trambling lesbian bondage .rar.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\british trambling several models lady (Sonja,Janette).mpeg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\indian animal bukkake voyeur hole hotel (Liz).zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\kicking horse voyeur hairy (Kathrin,Sarah).mpg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\beast several models balls .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\norwegian horse uncut .rar.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\malaysia lingerie big (Tatjana).mpeg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\xxx uncut .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\russian action horse several models titts (Ashley,Samantha).avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\chinese hardcore several models high heels .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\gay big titts balls (Janette).mpeg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\horse full movie glans boots .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\swedish handjob blowjob masturbation lady .mpg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\japanese gang bang bukkake catfight bondage .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\security\templates\horse uncut lady (Jenna,Samantha).avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\indian handjob beast catfight glans blondie .rar.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\gay [bangbus] .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\gang bang lingerie voyeur titts .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish animal trambling hidden cock .rar.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\kicking lesbian hidden balls .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\xxx [free] mature .rar.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\chinese lesbian masturbation sm .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\chinese fucking licking redhair (Jenna,Samantha).mpg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\spanish hardcore licking cock .mpg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\beast [free] (Melissa).zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\german horse [bangbus] young .rar.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\hardcore girls feet swallow .mpg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\danish beastiality hardcore masturbation .mpg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\InstallTemp\beastiality beast uncut cock 40+ (Tatjana).rar.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\swedish horse beast licking glans black hairunshaved (Tatjana).zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\mssrv.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\Downloaded Program Files\horse lesbian glans balls .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\danish kicking sperm big boots (Anniston,Sylvia).mpg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\danish cum gay catfight shoes .mpeg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\horse [bangbus] granny (Christine,Melissa).mpeg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\norwegian beast licking cock .rar.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\action lingerie uncut lady (Christine,Tatjana).zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\malaysia trambling public mistress .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\american fetish xxx [free] cock .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\black gang bang bukkake big pregnant .rar.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\indian handjob xxx uncut circumcision .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\brasilian gang bang blowjob catfight hole YEâPSè& .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\malaysia trambling licking .mpg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\spanish hardcore [milf] hole (Christine,Sarah).zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\malaysia lingerie catfight granny .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\gay [bangbus] hole bondage .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\blowjob full movie (Curtney).mpeg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\norwegian xxx voyeur feet girly (Janette).mpeg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\assembly\temp\american horse blowjob voyeur cock .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\sperm [milf] cock black hairunshaved .rar.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\sperm sleeping hole balls .mpeg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\brasilian porn blowjob [milf] mature .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\xxx lesbian glans 40+ .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\bukkake hidden (Sylvia).avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\chinese beast [free] (Liz).mpg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\fetish horse public redhair .zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\assembly\tmp\tyrkish animal sperm hidden cock wifey .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\norwegian gay public glans shoes .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\british hardcore sleeping (Samantha).mpg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\lesbian licking blondie (Sonja,Curtney).zip.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\american animal horse [milf] sm (Christine,Tatjana).mpg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\spanish beast sleeping shower .avi.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\fetish fucking several models .rar.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\malaysia blowjob licking cock .mpeg.exe 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2512 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2956 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 28 PID 2480 wrote to memory of 2956 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 28 PID 2480 wrote to memory of 2956 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 28 PID 2480 wrote to memory of 2956 2480 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 28 PID 2956 wrote to memory of 2512 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 29 PID 2956 wrote to memory of 2512 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 29 PID 2956 wrote to memory of 2512 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 29 PID 2956 wrote to memory of 2512 2956 6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe"C:\Users\Admin\AppData\Local\Temp\6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe"C:\Users\Admin\AppData\Local\Temp\6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe"C:\Users\Admin\AppData\Local\Temp\6e24c1a21a715d4af5ca65cb3f2c1a142b8c9a3c68f2ad17b83d85822da2099e.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2512
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
870KB
MD54e971ce4b6c0a831a2038b93054f347a
SHA1fdee85a8e75053040accfc1aed5a00f3c143596e
SHA25612258c697311b5c5a31aa8d55a40e6554b74ecc42389eba2023ea7613af7ed8d
SHA5123c0e35676be3ab545c8d80e721b2b5a0fef98170ca71a04f2da350b37e4f6d7aba91d7359a39cb49ce280852392e5f27241a61681f5e081237b662e0c0d4e889