Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 00:22
Behavioral task
behavioral1
Sample
e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe
-
Size
304KB
-
MD5
8814c0e335f1770237df4fe8d6c4def4
-
SHA1
8d619541fe00f622bf134443c86f6f2751877c63
-
SHA256
e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540
-
SHA512
fdd6188746e49034e5bdba38a92db4c77b447dbba3c60cc1f23b8e21b70d8154c725e6bbd84ecffe5a14cb3c0ddce6e8103ae3bb4db429ff4ff44a708c4f7815
-
SSDEEP
6144:aDOxZXPIo5R4nM/40yJSUGhXm5gKHcMu5pGB3UtDZKxG:lXpqhSUsm+HGKtUG
Score
9/10
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 15 IoCs
resource yara_rule behavioral2/memory/1820-11-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3952-12-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3640-31-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4424-38-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1820-39-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3952-90-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3952-92-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3952-153-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3952-157-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3952-184-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3952-189-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3952-193-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3952-208-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3952-216-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3952-220-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 17 IoCs
resource yara_rule behavioral2/memory/3952-0-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/files/0x0007000000023233-5.dat UPX behavioral2/memory/1820-11-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3952-12-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3640-31-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4424-38-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/1820-39-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3952-90-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3952-92-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3952-153-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3952-157-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3952-184-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3952-189-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3952-193-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3952-208-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3952-216-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3952-220-0x0000000000400000-0x000000000041B000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3952-0-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/files/0x0007000000023233-5.dat upx behavioral2/memory/1820-11-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3952-12-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3640-31-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4424-38-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/1820-39-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3952-90-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3952-92-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3952-153-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3952-157-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3952-184-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3952-189-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3952-193-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3952-208-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3952-216-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3952-220-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\T: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\V: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\X: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\S: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\W: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\G: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\H: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\J: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\L: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\M: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\R: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\I: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\N: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\O: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\P: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\Q: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\Z: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\B: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\E: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\K: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\U: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File opened (read-only) \??\Y: e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\chinese xxx kicking [milf] 50+ (Gina).rar.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\chinese beastiality public .rar.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\porn beast masturbation .zip.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SysWOW64\config\systemprofile\brasilian blowjob gay big .mpg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\chinese lesbian fucking full movie traffic .mpeg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\System32\DriverStore\Temp\beast kicking big gorgeoushorny (Sonja).zip.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SysWOW64\FxsTmp\action fucking full movie sm .mpeg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SysWOW64\IME\SHARED\american blowjob trambling hidden (Janette,Jade).mpg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\horse nude hidden nipples (Gina).mpeg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SysWOW64\FxsTmp\black lesbian sperm public hole .mpg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SysWOW64\IME\SHARED\chinese cum sperm several models castration .mpg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\danish kicking trambling licking penetration .rar.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\trambling full movie .avi.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files (x86)\Microsoft\Temp\french beastiality sleeping titts hairy .mpeg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\gang bang public .zip.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files\Microsoft Office\Updates\Download\japanese fucking sleeping .avi.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\beast sleeping boobs boots .avi.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\canadian action [free] circumcision (Kathrin).zip.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files (x86)\Google\Update\Download\swedish beast hardcore lesbian circumcision .avi.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files\Common Files\microsoft shared\chinese beastiality gang bang [free] glans (Sylvia,Janette).rar.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\horse gang bang uncut feet traffic (Christine).zip.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\nude girls .rar.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files (x86)\Google\Temp\french animal horse masturbation vagina .mpg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\canadian gang bang beast voyeur .mpeg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files\dotnet\shared\spanish fucking lesbian [milf] (Britney).rar.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\black fucking public stockings .rar.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\beast kicking [bangbus] granny .mpg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files\Microsoft Office\root\Templates\cumshot hidden fishy (Tatjana).rar.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\horse [bangbus] shoes .mpeg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\french gay kicking full movie cock high heels .mpg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe -
Drops file in Windows directory 28 IoCs
description ioc Process File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\german handjob hardcore sleeping hole ash .rar.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\assembly\temp\gang bang beast licking cock .mpeg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\italian porn horse full movie .mpeg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\kicking hidden bondage .avi.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\security\templates\japanese hardcore hidden ejaculation .mpg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\japanese blowjob girls nipples .avi.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\Downloaded Program Files\brasilian lesbian voyeur balls .zip.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\italian handjob several models .rar.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\porn horse [bangbus] .rar.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\action [free] (Anniston).mpg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\danish horse girls pregnant .mpg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\italian handjob cumshot catfight cock ejaculation .mpg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\tyrkish nude voyeur .zip.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\PLA\Templates\italian fucking [free] balls (Curtney).zip.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\british fetish beastiality voyeur hotel (Sarah).zip.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\american horse beast sleeping .zip.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\tyrkish hardcore horse [milf] shower .avi.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\lesbian full movie bondage .mpeg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\assembly\tmp\kicking big sweet .mpeg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\mssrv.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\InputMethod\SHARED\african sperm beastiality masturbation vagina gorgeoushorny .rar.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\canadian beastiality blowjob full movie upskirt (Jade).zip.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\CbsTemp\danish gay xxx [bangbus] .mpeg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\tyrkish handjob beastiality lesbian nipples stockings .zip.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SoftwareDistribution\Download\brasilian kicking fetish hot (!) nipples .mpeg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\handjob trambling full movie mature (Liz,Ashley).rar.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\british cum kicking several models (Karin,Britney).rar.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\handjob porn [milf] fishy .mpeg.exe e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 1820 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 1820 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 1820 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 1820 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 1820 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 1820 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 1820 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 1820 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 1820 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 1820 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 1820 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 1820 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 1820 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 1820 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 4424 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3952 wrote to memory of 3640 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 87 PID 3952 wrote to memory of 3640 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 87 PID 3952 wrote to memory of 3640 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 87 PID 3952 wrote to memory of 4424 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 90 PID 3952 wrote to memory of 4424 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 90 PID 3952 wrote to memory of 4424 3952 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 90 PID 3640 wrote to memory of 1820 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 92 PID 3640 wrote to memory of 1820 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 92 PID 3640 wrote to memory of 1820 3640 e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe"C:\Users\Admin\AppData\Local\Temp\e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe"C:\Users\Admin\AppData\Local\Temp\e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe"C:\Users\Admin\AppData\Local\Temp\e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820
-
-
-
C:\Users\Admin\AppData\Local\Temp\e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe"C:\Users\Admin\AppData\Local\Temp\e30f190df0c95819e88d654613f7460d916650468d794c4e8cc72928f5454540.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\horse gang bang uncut feet traffic (Christine).zip.exe
Filesize1.4MB
MD58c1e12a7b124a159988cd89832f4c4e0
SHA100020e195a323d070eaaf01cc7134597ce92f9c2
SHA256e3046649e32141e4be6a4e581859168f1b30e7ff5ddb1100280ddf5dcb47d769
SHA5125f58484950408e949e42767214cc2b8b8f23f3d1e98250557221b8a8dd48c1f8d80ab3436ae069c223c12c74c98f25155b0614e6bad82abc22b39e663c81ced7