Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2024, 18:45
Behavioral task
behavioral1
Sample
108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe
Resource
win10v2004-20240226-en
General
-
Target
108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe
-
Size
1.3MB
-
MD5
27583575012bbba8c5a131675a2c93f4
-
SHA1
90e0ca9ee29499452f793b552d337d1bbeab8e5c
-
SHA256
108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7
-
SHA512
8f256f768263671bbdd7e14f20587abcc7df240a97e7a633705a50244c56ebd4af93528739eb678060e16a3f64c0396126f2f7fdd737c1dfb55a841b3369588d
-
SSDEEP
24576:lUjjbfUt8nE3CbEbtJFzd+DDzOZFHSDzYqGooJHoYG2SH0:+fIenzop3zwjOZFIYqGootod2f
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 20 IoCs
resource yara_rule behavioral2/memory/1568-55-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2188-170-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1228-171-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-189-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1568-190-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2188-192-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1228-193-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-194-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-200-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-210-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-214-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-219-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-223-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-227-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-231-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-235-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-239-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-243-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-247-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-251-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 22 IoCs
resource yara_rule behavioral2/memory/2964-0-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/files/0x00080000000231e0-5.dat UPX behavioral2/memory/1568-55-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2188-170-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/1228-171-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2964-189-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/1568-190-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2188-192-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/1228-193-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2964-194-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2964-200-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2964-210-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2964-214-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2964-219-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2964-223-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2964-227-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2964-231-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2964-235-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2964-239-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2964-243-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2964-247-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2964-251-0x0000000000400000-0x000000000041B000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/2964-0-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/files/0x00080000000231e0-5.dat upx behavioral2/memory/1568-55-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2188-170-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/1228-171-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2964-189-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/1568-190-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2188-192-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/1228-193-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2964-194-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2964-200-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2964-210-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2964-214-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2964-219-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2964-223-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2964-227-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2964-231-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2964-235-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2964-239-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2964-243-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2964-247-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2964-251-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\Z: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\E: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\G: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\H: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\I: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\Q: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\R: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\J: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\K: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\B: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\M: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\S: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\T: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\W: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\X: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\A: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\L: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\N: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\O: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\P: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\V: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File opened (read-only) \??\Y: 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\spanish lesbian fucking hot (!) .zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\SysWOW64\config\systemprofile\asian trambling several models shoes .avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\SysWOW64\FxsTmp\bukkake uncut legs pregnant .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\beast bukkake uncut (Tatjana,Gina).zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\chinese xxx gay sleeping swallow (Sylvia).mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\System32\DriverStore\Temp\tyrkish blowjob hot (!) circumcision .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\SysWOW64\FxsTmp\german porn hidden .zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\SysWOW64\IME\SHARED\lesbian [milf] glans .zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\SysWOW64\IME\SHARED\malaysia lesbian gay voyeur feet bedroom .mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\SysWOW64\config\systemprofile\beast several models feet girly (Christine,Janette).avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\british lingerie lingerie hot (!) nipples sweet .mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\spanish xxx beastiality hidden cock .mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe -
Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\japanese blowjob masturbation .avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files\Microsoft Office\root\Templates\swedish fetish porn hot (!) (Liz).zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\indian lesbian hidden (Sonja).mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\danish animal licking mistress (Britney).mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\cumshot trambling masturbation upskirt (Tatjana).rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\blowjob hidden .avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files (x86)\Microsoft\Temp\african action licking black hairunshaved .avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files\Common Files\microsoft shared\british porn lesbian shoes .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\chinese kicking uncut (Curtney,Anniston).avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\lingerie sleeping boots (Melissa).mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\brasilian trambling lesbian several models nipples (Janette,Christine).rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\chinese beast masturbation legs sm (Samantha,Sonja).mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files (x86)\Google\Temp\danish cum sleeping pregnant .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\brasilian animal nude [bangbus] pregnant (Samantha).mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files\Microsoft Office\Updates\Download\spanish beastiality catfight boobs .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\african blowjob lesbian .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files (x86)\Google\Update\Download\xxx sleeping ash .mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\sperm trambling licking .mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Program Files (x86)\Microsoft\Temp\EU8B19.tmp\black sperm bukkake hot (!) .mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\InputMethod\SHARED\fetish licking castration .zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\cum horse [bangbus] ash .avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\x86_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_231ddfc33015c6db\asian gay several models boots (Jade,Sarah).avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\cumshot kicking [bangbus] (Britney).avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\french handjob kicking [free] YEâPSè& (Kathrin).zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\brasilian lingerie hidden legs (Melissa).avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\danish cumshot [bangbus] 40+ (Curtney,Sylvia).mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\beastiality masturbation penetration .mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\chinese handjob fucking lesbian .avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\blowjob full movie high heels (Karin,Sarah).mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\canadian bukkake animal sleeping 40+ .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\blowjob animal several models feet .mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\french horse uncut .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\german lesbian lingerie hot (!) vagina (Sandy,Tatjana).rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\Downloaded Program Files\russian gay trambling several models glans .mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\black hardcore handjob [milf] (Janette).mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\kicking fucking full movie .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\malaysia blowjob uncut titts .mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\italian kicking [free] .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\malaysia hardcore beast full movie (Curtney,Samantha).rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\swedish horse girls cock (Janette).mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\kicking kicking big .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\cumshot sleeping titts .avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_b201c2e68d8dbc0d\indian horse lingerie lesbian glans (Sonja,Sonja).zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\japanese cum big feet penetration .zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\danish beastiality hidden girly (Sylvia).mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\brasilian action nude hidden (Ashley).avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\horse voyeur .mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\italian trambling beastiality voyeur .mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\swedish action voyeur Ôï (Gina,Curtney).zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\british sperm nude voyeur .zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\kicking porn catfight bondage .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\russian animal catfight .mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\CbsTemp\horse hidden feet .mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\porn public fishy .mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\gang bang nude [free] sm (Sarah).mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\bukkake horse lesbian legs bondage .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\german horse big stockings .mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\spanish cum [free] nipples leather (Sarah).zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\action bukkake uncut nipples black hairunshaved .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\swedish lingerie cum uncut legs .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\lesbian licking glans balls .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\action cumshot [bangbus] (Sandy).mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\horse trambling masturbation .mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\chinese gang bang sperm lesbian traffic .mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\russian beast horse hidden (Kathrin).rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\malaysia nude hot (!) legs .mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\spanish blowjob big (Jenna).zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\cumshot [free] legs .mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\InstallTemp\indian gay animal several models granny (Curtney,Karin).rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\indian hardcore licking (Karin).zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\porn cum hidden vagina 40+ (Britney,Karin).zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\porn blowjob voyeur (Liz,Jenna).zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\fucking public .zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\french handjob horse hot (!) hole swallow .mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\porn fetish masturbation bedroom .zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\blowjob sleeping bondage .zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\blowjob fetish voyeur legs shoes .mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\beastiality licking .zip.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\swedish gang bang cumshot hidden (Liz,Anniston).avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\beast animal hidden gorgeoushorny (Gina).mpeg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\fucking lingerie full movie .avi.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\african gay blowjob big ejaculation .rar.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\beastiality big vagina (Gina,Kathrin).mpg.exe 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1228 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1228 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1228 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1228 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1228 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1228 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1228 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1228 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1228 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1228 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1228 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1228 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1228 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1228 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 2188 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2964 wrote to memory of 1568 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 90 PID 2964 wrote to memory of 1568 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 90 PID 2964 wrote to memory of 1568 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 90 PID 2964 wrote to memory of 2188 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 95 PID 2964 wrote to memory of 2188 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 95 PID 2964 wrote to memory of 2188 2964 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 95 PID 1568 wrote to memory of 1228 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 96 PID 1568 wrote to memory of 1228 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 96 PID 1568 wrote to memory of 1228 1568 108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe"C:\Users\Admin\AppData\Local\Temp\108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe"C:\Users\Admin\AppData\Local\Temp\108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe"C:\Users\Admin\AppData\Local\Temp\108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1228
-
-
-
C:\Users\Admin\AppData\Local\Temp\108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe"C:\Users\Admin\AppData\Local\Temp\108a34d9c5263d13c6380872b7a788e7651acb29edbb4965eee2dfda54f3d7d7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2188
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\brasilian animal nude [bangbus] pregnant (Samantha).mpeg.exe
Filesize244KB
MD5c0e7c5ab583f0c5dc3ba8ceffff7bf83
SHA1080c3d42fdea2dea9d0908aeab1ea64e3a5b527c
SHA2564694bb1132794b928fd71438986974eb447dd87da16ea46a0a7feaedf87c75cc
SHA512d0696d5b7d8bf1f05fb5451958465207d261c473db2525cc581605ec69bdc05c2e80398af9e56f012998fd24efb5264c552a45f81ed7da22a11584f9113f4340