3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
Size

2.0MB
MD5

c1ddb6def8f632d8a07400d2cc385a0c
SHA1

9bea8ecd11e0abe8813497d696f564238493eef0
SHA256

3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58
SHA512

0306059b8b9586ba462b37d2c7b12da2f47cbc194fd8aa818812ab73f643a95a22a3f1fcf8440665629d2c693253c21d0a75a411f982e52bca7256165f4a7224
SSDEEP

49152:I/00Oz3EnWE2xUb/5xWT9nI1B6QY00OFQ:I/4z3D4/5sn8nYrOa

Score

9^/10

persistence spyware stealer

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 19 IoCs

resource	yara_rule
behavioral1/memory/2968-11-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2432-57-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2464-58-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-93-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2968-94-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-97-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-98-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-104-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-108-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-122-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-126-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-130-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-134-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-140-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-144-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-148-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-152-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-156-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2060-160-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 21 IoCs

resource	yara_rule
behavioral1/memory/2060-0-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/files/0x00070000000155ef-5.dat	UPX
behavioral1/memory/2968-11-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2432-57-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2464-58-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-93-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2968-94-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-97-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-98-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-104-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-108-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-122-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-126-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-130-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-134-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-140-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-144-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-148-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-152-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-156-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2060-160-0x0000000000400000-0x000000000041C000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\A:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\I:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\O:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\T:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\W:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\Q:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\U:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\B:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\E:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\G:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\H:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\L:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\P:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\Y:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\X:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\Z:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\J:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\K:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\M:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\R:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\S:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File opened (read-only)	\??\V:	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\IME\shared\russian porn sperm lesbian (Karin).mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\russian cumshot gay hot (!) cock .mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\SysWOW64\config\systemprofile\black kicking fucking [bangbus] cock .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish animal horse lesbian glans .mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\SysWOW64\config\systemprofile\hardcore public .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\System32\DriverStore\Temp\brasilian kicking gay [bangbus] (Sarah).zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\SysWOW64\FxsTmp\japanese handjob lesbian full movie swallow (Sandy,Curtney).avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\SysWOW64\IME\shared\sperm uncut granny .rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian fetish lingerie sleeping feet .avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\SysWOW64\FxsTmp\porn fucking [milf] cock shoes .mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\gay catfight cock boots .avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\xxx [milf] hole (Sonja,Samantha).avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\sperm full movie hairy .mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\tyrkish nude fucking sleeping glans blondie (Samantha).mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\tyrkish action fucking girls .mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\american fetish bukkake lesbian upskirt .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\japanese cumshot hardcore uncut latex .mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Program Files\Common Files\Microsoft Shared\sperm uncut cock latex (Samantha).mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Program Files\DVD Maker\Shared\russian kicking trambling public cock swallow .rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Program Files\Windows Journal\Templates\indian action hardcore girls titts shoes .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\trambling uncut blondie (Kathrin,Tatjana).rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\japanese handjob fucking several models glans penetration .rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\indian cumshot blowjob big swallow (Sonja,Sarah).rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Program Files (x86)\Google\Update\Download\black beastiality sperm big (Sylvia).mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\trambling voyeur glans .rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\brasilian action hardcore masturbation redhair .mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\malaysia trambling sleeping .mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\assembly\tmp\italian fetish lingerie catfight (Melissa).zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\Downloaded Program Files\american gang bang bukkake public mistress .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\sperm hot (!) titts (Christine,Sylvia).rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\italian handjob lesbian sleeping glans sweet .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\cum blowjob lesbian hole .mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\beast licking black hairunshaved .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\french fucking public hole (Sonja,Melissa).mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\british blowjob big titts .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\japanese action hardcore licking .avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\japanese kicking blowjob full movie (Karin).rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\action horse sleeping feet .rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\SoftwareDistribution\Download\italian handjob lesbian [free] (Karin).zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\malaysia lingerie catfight .mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\handjob blowjob full movie hole young (Tatjana).avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\mssrv.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\beastiality xxx voyeur (Sarah).rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\nude lingerie catfight .mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\nude gay sleeping glans leather (Samantha).mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\beast hot (!) hairy .rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\cum beast masturbation titts swallow (Tatjana).avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\InstallTemp\indian animal bukkake big (Karin).zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\sperm public titts gorgeoushorny .mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\brasilian cumshot trambling lesbian glans .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\cum lesbian hidden beautyfull .rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\nude bukkake public glans hairy (Curtney).mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\handjob xxx big glans balls (Liz).mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\indian animal lingerie [free] feet beautyfull (Jade).mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\kicking trambling catfight .rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\italian beastiality gay masturbation (Jade).mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\french xxx [bangbus] cock lady .mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\horse blowjob sleeping titts .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\russian cum horse hot (!) cock latex .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\swedish beastiality gay licking .mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\french trambling catfight glans .mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\japanese fetish gay [bangbus] YEâPSè& .rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\black porn hardcore [free] young (Jenna,Liz).mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\malaysia lesbian catfight (Tatjana).mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\italian cumshot gay public .avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\german fucking hidden cock mistress .mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\japanese animal fucking big gorgeoushorny .mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\american cumshot blowjob [bangbus] (Liz).mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\american gang bang horse lesbian granny .rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\bukkake hot (!) femdom .mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\german lingerie masturbation beautyfull .avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\canadian hardcore lesbian cock .mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\indian horse beast masturbation .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\japanese cumshot blowjob uncut hole leather (Samantha).mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\american handjob gay several models cock ejaculation .mpg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\brasilian action fucking public titts .avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\beastiality lesbian masturbation (Curtney).rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\black action blowjob [free] titts .avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\danish kicking gay catfight 40+ .avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\chinese bukkake full movie feet femdom .avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\action gay licking .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\horse lingerie sleeping .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\cum blowjob sleeping titts fishy (Sarah).zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\black porn hardcore [bangbus] swallow .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\malaysia beast public high heels .avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\cum xxx licking shoes .avi.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\security\templates\brasilian kicking xxx voyeur titts .mpeg.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\beast several models .zip.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\cum trambling big (Liz).rar.exe	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2464	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
2432	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2968	2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe	28
PID 2060 wrote to memory of 2968	2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe	28
PID 2060 wrote to memory of 2968	2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe	28
PID 2060 wrote to memory of 2968	2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe	28
PID 2060 wrote to memory of 2432	2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe	29
PID 2060 wrote to memory of 2432	2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe	29
PID 2060 wrote to memory of 2432	2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe	29
PID 2060 wrote to memory of 2432	2060	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe	29
PID 2968 wrote to memory of 2464	2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe	30
PID 2968 wrote to memory of 2464	2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe	30
PID 2968 wrote to memory of 2464	2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe	30
PID 2968 wrote to memory of 2464	2968	3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe	30

C:\Users\Admin\AppData\Local\Temp\3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
"C:\Users\Admin\AppData\Local\Temp\3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
  "C:\Users\Admin\AppData\Local\Temp\3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Users\Admin\AppData\Local\Temp\3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
    "C:\Users\Admin\AppData\Local\Temp\3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2464
- C:\Users\Admin\AppData\Local\Temp\3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe
  "C:\Users\Admin\AppData\Local\Temp\3c9c8f15778d91ae300541f5a22fe2ea9cd4084b01daa4a642ca41f1cb8c9f58.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\trambling uncut blondie (Kathrin,Tatjana).rar.exe

Filesize
146KB

MD5
8ca9b59d486bb064bf5d945ddc68156f

SHA1
648e17029d9bc939cd17e6aa74e084fc00974279

SHA256
53bcfb87e479d209ba4efced5813bc8a517638d1115971a7826691c85a5d7a7c

SHA512
dc13ed979a80196e6322e6f31f092040acf3e5baef8e85ebb2d11d5f7f63c62673e24e65bd942eab5dba231c5919bba3bab1f5456f71bbc9c75c51abf1d74431

Download Submit
memory/2060-140-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-160-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-100-0x0000000004AD0000-0x0000000004AEC000-memory.dmp

Filesize
112KB

Download
memory/2060-56-0x0000000004AD0000-0x0000000004AEC000-memory.dmp

Filesize
112KB

Download
memory/2060-104-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-156-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-93-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-152-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-97-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-108-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-148-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-10-0x0000000004AC0000-0x0000000004ADC000-memory.dmp

Filesize
112KB

Download
memory/2060-98-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-122-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-126-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-130-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-134-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2060-144-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2432-57-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2464-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-11-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-94-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download