Analysis
-
max time kernel
157s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2024, 19:05
Behavioral task
behavioral1
Sample
1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe
Resource
win10v2004-20240226-en
General
-
Target
1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe
-
Size
221KB
-
MD5
24aed50190556d9869486494512463a2
-
SHA1
da03ac8ba0b2bfd789be9150590b6111b64395d1
-
SHA256
1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47
-
SHA512
89d25e61492b2fbd853fdcdc2e4e384498dbfbf0af8b622e11066ad16632e1989ed8c7b7d1470917426b6065b84da2382521a2bc86a3caa8236692dbf78ab6c8
-
SSDEEP
3072:y9jbLl/gvQout8YbUzch3bNY0n1z3G86rG56dxTsNVOwHKTP0Og7IH9+ekc:0jluQoS80m0pG86i2xOdqzgw+Hc
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 15 IoCs
resource yara_rule behavioral2/memory/3332-19-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2024-26-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4528-27-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4348-28-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3332-29-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3332-153-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3332-170-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3332-174-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3332-178-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3332-182-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3332-188-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3332-198-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3332-205-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3332-224-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3332-228-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 18 IoCs
resource yara_rule behavioral2/memory/3332-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/files/0x0009000000023232-5.dat UPX behavioral2/memory/2024-10-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3332-19-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2024-26-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4528-27-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4348-28-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3332-29-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3332-153-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3332-170-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3332-174-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3332-178-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3332-182-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3332-188-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3332-198-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3332-205-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3332-224-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3332-228-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3332-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/files/0x0009000000023232-5.dat upx behavioral2/memory/2024-10-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3332-19-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2024-26-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4528-27-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4348-28-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3332-29-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3332-153-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3332-170-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3332-174-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3332-178-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3332-182-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3332-188-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3332-198-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3332-205-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3332-224-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3332-228-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\J: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\O: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\P: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\H: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\M: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\S: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\T: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\U: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\A: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\B: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\E: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\Y: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\Q: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\V: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\W: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\I: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\K: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\L: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\Z: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\G: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\N: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File opened (read-only) \??\R: 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\System32\LogFiles\Fax\Incoming\british trambling kicking big .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\black trambling lesbian sleeping .avi.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\SysWOW64\FxsTmp\blowjob horse sleeping beautyfull .rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\lesbian animal sleeping pregnant .avi.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\canadian beast action hidden .mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\System32\DriverStore\Temp\gang bang fetish uncut hole sm (Janette).rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\SysWOW64\FxsTmp\indian beast hot (!) titts (Sylvia).avi.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\SysWOW64\IME\SHARED\french beastiality [bangbus] fishy (Sonja).rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\french trambling uncut (Sonja).zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\SysWOW64\config\systemprofile\german cum big shower (Anniston).zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\SysWOW64\IME\SHARED\xxx big .rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\SysWOW64\config\systemprofile\handjob uncut vagina .mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\italian beastiality trambling full movie pregnant .avi.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files\dotnet\shared\gay sperm [milf] hole .mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\lingerie sperm [free] legs pregnant (Kathrin).rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files\Microsoft Office\Updates\Download\indian beastiality big circumcision .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\lingerie hidden .rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\xxx porn hidden vagina balls .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files (x86)\Microsoft\Temp\nude horse voyeur castration (Curtney).mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\spanish action cumshot masturbation ejaculation .mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\norwegian kicking hot (!) cock traffic (Sonja).mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\german kicking catfight .mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\lesbian girls black hairunshaved .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files (x86)\Google\Temp\danish nude fucking uncut .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\lingerie sperm sleeping hairy .avi.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files\Common Files\microsoft shared\swedish lingerie lesbian ash (Sandy,Sandy).avi.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files\Microsoft Office\root\Templates\indian horse catfight glans .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\black hardcore animal uncut fishy (Anniston,Britney).zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files (x86)\Google\Update\Download\beast cum several models hole mistress .rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\swedish beast fetish [free] .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\swedish fucking catfight YEâPSè& .mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\norwegian gay [free] ejaculation (Kathrin).zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\italian handjob [bangbus] vagina circumcision .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\lingerie action catfight vagina (Jenna).rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\danish lesbian full movie .mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\canadian blowjob hot (!) stockings .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\italian action uncut YEâPSè& .rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\gay [free] ejaculation .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\french sperm public ash .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\animal uncut .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\bukkake girls penetration .avi.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\assembly\tmp\indian gay hidden upskirt .mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\japanese beastiality nude licking vagina granny (Ashley,Christine).rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\kicking [milf] glans wifey .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\gay [free] .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\norwegian horse voyeur pregnant .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\spanish nude hot (!) feet ash (Melissa,Sonja).avi.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\horse [free] cock granny (Kathrin).rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\french lesbian full movie legs .rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\bukkake action public (Sylvia,Anniston).avi.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\norwegian lingerie cum hot (!) .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\french beast trambling voyeur castration .rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\hardcore cumshot girls vagina mature (Ashley).mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\black nude sleeping penetration (Samantha).rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\malaysia lingerie [free] legs stockings .rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\brasilian horse xxx big hairy .avi.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\blowjob gay hidden .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\beastiality nude girls upskirt .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\fucking full movie pregnant .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\horse licking stockings .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\beastiality hot (!) .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\malaysia porn horse licking young .mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\porn [milf] 40+ .avi.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\fetish catfight .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\black kicking girls glans .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\lingerie sperm several models .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\fucking public .rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\chinese sperm xxx [bangbus] .rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\trambling action hidden .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\spanish hardcore beast voyeur (Tatjana,Anniston).rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\nude girls titts .rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\spanish gay [milf] glans beautyfull .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\animal cum hot (!) .mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\chinese handjob lesbian uncut pregnant .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\sperm action [milf] (Ashley,Sandy).mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\japanese handjob lesbian .avi.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\french porn sleeping .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\bukkake big .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\lesbian blowjob voyeur mistress (Christine,Christine).mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\nude nude public circumcision .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\spanish trambling [milf] nipples shoes .mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\beast girls .rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\black horse lesbian licking glans .rar.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\african lingerie xxx big (Janette).zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\asian porn hardcore big sm .mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\mssrv.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\animal [free] nipples .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\Downloaded Program Files\british gang bang big (Sonja,Jade).mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\trambling fucking voyeur boobs young .avi.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\kicking blowjob public legs .mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\norwegian handjob catfight castration .zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\cum sleeping (Sandy).zip.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\spanish lingerie masturbation hotel .mpg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\american beast several models legs shower .mpeg.exe 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4348 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4348 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4348 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4348 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4348 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4348 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4348 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4348 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4348 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4348 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4348 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4348 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4348 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4348 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 4528 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3332 wrote to memory of 2024 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 87 PID 3332 wrote to memory of 2024 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 87 PID 3332 wrote to memory of 2024 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 87 PID 3332 wrote to memory of 4528 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 88 PID 3332 wrote to memory of 4528 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 88 PID 3332 wrote to memory of 4528 3332 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 88 PID 2024 wrote to memory of 4348 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 89 PID 2024 wrote to memory of 4348 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 89 PID 2024 wrote to memory of 4348 2024 1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe"C:\Users\Admin\AppData\Local\Temp\1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe"C:\Users\Admin\AppData\Local\Temp\1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe"C:\Users\Admin\AppData\Local\Temp\1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348
-
-
-
C:\Users\Admin\AppData\Local\Temp\1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe"C:\Users\Admin\AppData\Local\Temp\1a34253532e6b4a0d3a1072f2576fd93cc0700e2df4f23a79ed5a7588a818b47.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\lingerie sperm [free] legs pregnant (Kathrin).rar.exe
Filesize1.6MB
MD5e9d90e7a9fac03ab037af4944db0e04d
SHA18585931a00de9cc1f3deee71cfd30271c3204970
SHA2566f6798281ec6d54a85bb2a8a52b0fce4dce0f230723e1917f564ec131ccff0dc
SHA512d452a71b6c139040e804253397a17c368098878f401fdfca483f2f72aab836aaef988e7a9534dd0e28dd7b10fe7f3f33bb35ea33edfbb9fa63d214f07678bd7c