dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
Size

1.2MB
MD5

10415a8dac646b7fb2c89e9635a87168
SHA1

5f0a74416b3910a600de7caaf132cc96d6480c19
SHA256

dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e
SHA512

78618e3ec9b51770a0884540f36c4b967d42d89cde551d8c1b9deb5f2798ad2c23d08dbaf3d7988312d3274cb6ce5568348f54685e6c9aaa66690b20638cffb7
SSDEEP

24576:lq88El42w6Nmy33NX5UzBpQsBHfPlMDJ8HfmKoJkNloStdlW51Lq0rJn:EElqyHNGnx/9MDJ8H3zoStvWjn

Score

9^/10

persistence spyware stealer

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 19 IoCs

resource	yara_rule
behavioral1/memory/2388-63-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-92-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2580-93-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2388-94-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1164-95-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-96-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-97-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-103-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-107-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-121-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-125-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-129-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-133-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-139-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-143-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-147-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-151-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-155-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1704-159-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 23 IoCs

resource	yara_rule
behavioral1/memory/1704-24-0x0000000005500000-0x000000000551C000-memory.dmp	UPX
behavioral1/files/0x00120000000155d9-5.dat	UPX
behavioral1/memory/1704-0-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2388-63-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1164-64-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-92-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2580-93-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2388-94-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1164-95-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-96-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-97-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-103-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-107-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-121-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-125-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-129-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-133-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-139-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-143-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-147-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-151-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-155-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1704-159-0x0000000000400000-0x000000000041C000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\J:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\K:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\O:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\P:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\U:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\Z:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\A:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\L:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\M:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\N:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\V:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\E:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\Q:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\S:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\W:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\H:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\I:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\R:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\T:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\X:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\Y:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File opened (read-only)	\??\G:	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\xxx big feet (Britney,Samantha).avi.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\System32\DriverStore\Temp\danish cum horse big ejaculation .zip.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\SysWOW64\FxsTmp\tyrkish nude lesbian lesbian .zip.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\SysWOW64\config\systemprofile\japanese action hardcore hot (!) titts .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\SysWOW64\FxsTmp\italian gang bang trambling [free] .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\SysWOW64\IME\shared\lesbian [bangbus] girly .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\SysWOW64\config\systemprofile\lesbian lesbian titts gorgeoushorny .avi.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\tyrkish kicking fucking uncut titts shoes .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\gay lesbian glans leather .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\SysWOW64\IME\shared\fucking uncut wifey .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\danish horse trambling [milf] .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Program Files\DVD Maker\Shared\american fetish sperm sleeping (Melissa).zip.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\blowjob uncut boots .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Program Files (x86)\Google\Update\Download\american gang bang xxx public feet (Anniston,Jade).avi.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\italian cumshot horse licking (Curtney).mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\bukkake uncut feet .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Program Files\Windows Journal\Templates\danish gang bang lingerie catfight hotel .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Program Files (x86)\Google\Temp\russian cumshot trambling full movie feet leather .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\trambling licking circumcision .zip.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\american animal horse lesbian hotel (Jenna,Melissa).avi.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\lesbian girls (Jade).mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\russian nude hardcore big .zip.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\sperm big .mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\tyrkish fetish horse uncut (Liz).avi.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sperm [milf] .avi.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\malaysia gay hidden hole .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\african lingerie uncut circumcision .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\tyrkish fetish blowjob [free] pregnant .avi.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\spanish bukkake voyeur traffic .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\canadian beast licking feet ejaculation (Karin).mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\kicking xxx voyeur cock boots (Jade).mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\brasilian handjob trambling [bangbus] .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\african lesbian voyeur bondage .avi.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\american handjob gay hot (!) girly (Sonja,Sarah).mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\norwegian horse masturbation feet lady .mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\cum gay masturbation femdom (Kathrin,Samantha).mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\swedish animal lingerie hot (!) ash .mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\asian xxx [milf] titts hotel .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\french beast [milf] feet .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\spanish sperm [free] ìï .mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\russian horse trambling [bangbus] glans boots (Karin).mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\black gang bang bukkake [milf] .mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\blowjob licking glans .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\porn beast uncut .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\norwegian beast licking granny .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\british trambling [milf] .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\PLA\Templates\american cumshot lesbian full movie glans sm .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\tyrkish animal sperm sleeping shoes .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\malaysia lesbian girls traffic .mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\american beastiality blowjob girls feet gorgeoushorny .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\black beastiality trambling lesbian glans .zip.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\african sperm [milf] glans traffic .avi.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\spanish beast full movie pregnant (Sandy,Sylvia).zip.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\trambling girls .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\french fucking masturbation stockings .zip.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\spanish lingerie catfight upskirt .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\lesbian [bangbus] glans (Jenna,Melissa).rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\tyrkish beastiality horse catfight hole .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\security\templates\hardcore public (Samantha).mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish beastiality bukkake several models penetration .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\SoftwareDistribution\Download\tyrkish nude fucking [milf] bondage (Kathrin,Jade).mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\cumshot fucking hidden (Sarah).mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\black handjob blowjob uncut sm .mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\malaysia hardcore full movie bondage (Sonja,Sarah).avi.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\asian fucking sleeping titts mature .avi.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\russian animal trambling catfight titts black hairunshaved .avi.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\swedish cumshot lesbian masturbation feet .zip.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\swedish animal fucking voyeur titts gorgeoushorny .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\animal sperm full movie (Liz).mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\indian porn gay catfight young .avi.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\trambling hot (!) balls .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\bukkake [milf] .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\french gay sleeping upskirt (Jenna,Sarah).mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\mssrv.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\sperm full movie mistress .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\assembly\tmp\black fetish horse public bedroom .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\fetish xxx full movie cock .mpeg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\russian kicking trambling catfight hole balls .zip.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\kicking trambling sleeping feet .mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\Temp\tyrkish gang bang sperm hot (!) blondie .rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\kicking xxx masturbation feet mistress .mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\fucking uncut glans .mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\danish gang bang xxx hidden blondie (Sandy,Jade).rar.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\beastiality trambling [milf] hole castration (Karin).mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\trambling [bangbus] YEâPSè& .mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\german lesbian several models glans (Sandy,Jade).mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\nude bukkake catfight hole girly (Tatjana).mpg.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\canadian lingerie voyeur .zip.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\horse voyeur upskirt .avi.exe	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1164	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
2388	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2580	1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe	28
PID 1704 wrote to memory of 2580	1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe	28
PID 1704 wrote to memory of 2580	1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe	28
PID 1704 wrote to memory of 2580	1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe	28
PID 2580 wrote to memory of 2388	2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe	29
PID 2580 wrote to memory of 2388	2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe	29
PID 2580 wrote to memory of 2388	2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe	29
PID 2580 wrote to memory of 2388	2580	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe	29
PID 1704 wrote to memory of 1164	1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe	30
PID 1704 wrote to memory of 1164	1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe	30
PID 1704 wrote to memory of 1164	1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe	30
PID 1704 wrote to memory of 1164	1704	dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe	30

C:\Users\Admin\AppData\Local\Temp\dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
"C:\Users\Admin\AppData\Local\Temp\dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Users\Admin\AppData\Local\Temp\dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2388
- C:\Users\Admin\AppData\Local\Temp\dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd80cfa97e28394be7494f4b8ddf07bb5c5c57b8118cbe3c3dbabf708c43e0e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\american animal horse lesbian hotel (Jenna,Melissa).avi.exe

Filesize
726KB

MD5
2949c5826c668373b5ba8ee0d86341b6

SHA1
db55a18b0e88a26b3a1f2e23751550d8fd11817c

SHA256
b39edc28cf091880e89490a877e50a2b41840dd11c41c078c1dab36e8a95ced7

SHA512
5ddde1145df1dbcb654b3549a409377d2c0ce8fdea71de74749014c30c07be8e04c79082c3317c47fcdd739008f00971238becf4e32dfb07980b04d6a0570235

Download Submit
C:\debug.txt

Filesize
183B

MD5
2be5a09242aaa8e3e3070a2e08e1ae49

SHA1
014c5d493bc2033e715e969abb7edf33e858f917

SHA256
bc44052d469fe0cb0708a1fc1a24245fdfae1e8a957d43f4e0f566379533770d

SHA512
2681255150dc78cca14c28e7cc37d4db9aee4870b4954add264f782bd60c62e8912a822ce6dd13593b913eccd6a07ea8960565e35b79353e63c4a6230663392f

Download Submit
memory/1164-64-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1164-95-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-98-0x0000000005500000-0x000000000551C000-memory.dmp

Filesize
112KB

Download
memory/1704-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-92-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-159-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-155-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-151-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-96-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-97-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-24-0x0000000005500000-0x000000000551C000-memory.dmp

Filesize
112KB

Download
memory/1704-103-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-107-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-147-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-121-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-125-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-129-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-133-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-139-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1704-143-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2388-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2388-94-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2580-62-0x0000000004940000-0x000000000495C000-memory.dmp

Filesize
112KB

Download
memory/2580-93-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download