Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 00:16
Behavioral task
behavioral1
Sample
b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe
Resource
win10v2004-20240226-en
General
-
Target
b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe
-
Size
285KB
-
MD5
a27e164a0f9b38f41484d7d97fe3d407
-
SHA1
55c3691d9f9094579edaf298483439e1ed1472cc
-
SHA256
b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe
-
SHA512
9497afdbe83ec4a359758fd0a51df1602d2ba53f863a157d4a4a427e47d6c195f46b6ed2983b27f2e6b59a6ef488c3b137f19137daea5758f159bf3367d234f9
-
SSDEEP
6144:aDOxZXPIo5R4nM/40yJ+YZRvw+QI4xR2YQk5tRrWfMrYkSR7hCq:lXpqh+YTw+QI4v2YFLBLrYkSRd7
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 20 IoCs
resource yara_rule behavioral1/memory/1072-10-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2632-54-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2384-55-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-90-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1072-91-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2384-93-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-94-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-95-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-101-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-105-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-119-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-123-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-127-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-131-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-137-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-141-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-145-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-149-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-153-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2256-157-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 22 IoCs
resource yara_rule behavioral1/memory/2256-0-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/files/0x0007000000014e3d-5.dat UPX behavioral1/memory/1072-10-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2632-54-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2384-55-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-90-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/1072-91-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2384-93-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-94-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-95-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-101-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-105-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-119-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-123-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-127-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-131-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-137-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-141-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-145-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-149-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-153-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2256-157-0x0000000000400000-0x000000000041B000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2256-0-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/files/0x0007000000014e3d-5.dat upx behavioral1/memory/1072-10-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2632-54-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2384-55-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-90-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1072-91-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2384-93-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-94-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-95-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-101-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-105-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-119-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-123-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-127-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-131-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-137-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-141-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-145-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-149-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-153-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2256-157-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\B: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\G: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\H: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\P: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\Q: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\A: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\I: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\O: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\R: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\S: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\W: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\X: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\Y: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\K: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\M: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\N: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\U: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\V: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\E: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\J: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\L: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File opened (read-only) \??\T: b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\horse voyeur (Tatjana).avi.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\SysWOW64\FxsTmp\asian lingerie catfight titts .mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\fucking girls titts circumcision (Melissa).mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\danish nude horse full movie wifey .zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\SysWOW64\config\systemprofile\fucking full movie .mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian horse lesbian big cock .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\SysWOW64\FxsTmp\xxx hidden .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\SysWOW64\IME\shared\american nude beast big boots .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\SysWOW64\IME\shared\indian animal lingerie [bangbus] hole penetration (Karin).mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\SysWOW64\config\systemprofile\russian action xxx full movie (Jade).mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\american handjob lesbian lesbian cock .mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Program Files\Windows Journal\Templates\lingerie licking shower .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Program Files (x86)\Common Files\microsoft shared\lesbian lesbian hole 40+ .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Program Files (x86)\Microsoft Office\Templates\japanese gang bang bukkake girls .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\tyrkish animal gay full movie cock wifey (Liz).avi.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sperm [milf] 50+ .mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Program Files\Common Files\Microsoft Shared\lingerie public glans boots .avi.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\hardcore [milf] (Tatjana).zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Program Files (x86)\Google\Update\Download\japanese action gay lesbian 40+ .zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\italian beastiality blowjob hidden (Sarah).avi.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\black action hardcore uncut lady .mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Program Files (x86)\Google\Temp\blowjob hot (!) feet .zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\japanese fetish horse hot (!) hole balls .mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\lingerie masturbation (Karin).mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Program Files\DVD Maker\Shared\blowjob [bangbus] .avi.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\PLA\Templates\bukkake lesbian hole circumcision .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\danish horse hardcore sleeping granny .mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\british trambling full movie penetration .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\danish fetish lesbian [bangbus] upskirt .avi.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\swedish cum horse full movie feet sm .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\animal lesbian girls femdom .zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\danish horse lingerie licking shower .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\danish cum bukkake catfight .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\beastiality trambling sleeping glans (Kathrin,Sylvia).mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\norwegian fucking sleeping wifey .zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\lingerie [free] YEâPSè& .avi.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\chinese lingerie big cock blondie (Sylvia).rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\brasilian beastiality trambling [free] bondage (Jenna,Sylvia).mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\bukkake licking hole hotel .avi.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\french lingerie uncut titts femdom (Tatjana).mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\malaysia beast several models leather .zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\asian sperm several models feet leather .zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\japanese cumshot gay hot (!) 40+ .zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\bukkake several models mistress .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\canadian hardcore lesbian ìï .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\horse hardcore [free] titts 40+ .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\swedish beastiality fucking several models cock femdom (Jade).avi.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\british beast masturbation stockings .zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\brasilian fetish sperm lesbian .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\italian cumshot hardcore hot (!) hole .zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\japanese nude xxx catfight wifey (Sonja,Sylvia).mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\cumshot hardcore big mature .mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\horse public feet mistress .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\russian cumshot xxx catfight titts boots (Jade).rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\american handjob bukkake [free] high heels .mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\fucking full movie feet (Britney,Sylvia).rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\lingerie public mature .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\black horse sperm catfight (Sarah).rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\lingerie full movie cock wifey (Janette).zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\lesbian [free] shower .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\danish beastiality bukkake full movie glans mistress .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\chinese gay voyeur bondage .mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\french blowjob girls feet castration .mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\malaysia lesbian big feet .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\gay [bangbus] ejaculation .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\malaysia gay [milf] stockings (Jenna,Liz).mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\handjob beast full movie .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\brasilian fetish bukkake catfight (Sarah).zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\bukkake big feet .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\italian animal trambling masturbation .mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\black handjob lesbian masturbation lady .zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\spanish gay sleeping upskirt .zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\gay full movie penetration .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\american nude gay [milf] feet castration (Janette).zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\indian nude blowjob lesbian feet shoes (Liz).rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\assembly\temp\american cumshot sperm full movie .zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\fucking catfight titts shower (Sylvia).zip.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\danish cum bukkake girls castration .avi.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\american fetish fucking girls penetration .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\nude bukkake [free] cock .mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\gang bang sperm lesbian feet ash .mpeg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\SoftwareDistribution\Download\beast hidden latex .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\nude lesbian licking cock upskirt .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\russian gang bang trambling hot (!) 40+ .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\spanish lingerie full movie hole pregnant .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\brasilian beastiality fucking public feet .mpg.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\swedish cum lingerie full movie fishy .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\kicking lesbian [free] .rar.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\indian kicking blowjob lesbian feet young .avi.exe b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2384 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 2632 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2256 wrote to memory of 1072 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 28 PID 2256 wrote to memory of 1072 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 28 PID 2256 wrote to memory of 1072 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 28 PID 2256 wrote to memory of 1072 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 28 PID 1072 wrote to memory of 2632 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 29 PID 1072 wrote to memory of 2632 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 29 PID 1072 wrote to memory of 2632 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 29 PID 1072 wrote to memory of 2632 1072 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 29 PID 2256 wrote to memory of 2384 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 30 PID 2256 wrote to memory of 2384 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 30 PID 2256 wrote to memory of 2384 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 30 PID 2256 wrote to memory of 2384 2256 b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe"C:\Users\Admin\AppData\Local\Temp\b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe"C:\Users\Admin\AppData\Local\Temp\b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe"C:\Users\Admin\AppData\Local\Temp\b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2632
-
-
-
C:\Users\Admin\AppData\Local\Temp\b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe"C:\Users\Admin\AppData\Local\Temp\b47cfffa9ce47d3706c519126e8a2718d834e1ae9e7aa891f0c61023b9e8d1fe.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5be91b7502ff2bc8194eb9bfd56c5794b
SHA1e1e71543b9d17560bfbe5e7bea5d55a43c454bb0
SHA256ec19b18eb3f7f5391994c0bd039b0da77682a3614d2f1e0931566cc4e9e03d2e
SHA5123b2c87ca272d066e31627688d43816bb55d10e2760c821042c1ef6e4ef80a75d06280ee6ed14122de42467c8700c917d629c00a46338e478b9052c7190bee6f3
-
Filesize
183B
MD55ed1d9188e5d393b99e47d4b910ab963
SHA1037ab82b0565b55fc38748e07c47dab60af62837
SHA256700749fbe0c27c6a488411b38041bfc208668c8db3f447edde9e1e9103c80340
SHA51238601564410f8d1c539c3bd831ab1d0dd13fa01414f38a95aaac40d8227f9313a2aec6a9cbd27214bf8d50e97daa096e3a388685b8f09fc7fa9fe241f82b77d1